npm security reports, with evidence.

The install-time, default cross-agent mutation meets the firewall block policy even though no exfiltration endpoint was confirmed. The documented behavior and installer source directly su...

Source directly establishes a default external credential receiver and sends authentication material to it during normal login. No lifecycle hook is needed for this concrete runtime crede...

The lifecycle behavior is concrete and automatic, not merely dormant tooling. Although shared agent-config migration is opt-in and no exfiltration was found, unprompted remote-script exec...

This is concrete unconsented postinstall mutation of foreign, global AI-agent control surfaces. The later provider calls are not needed for the block decision.

The guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeo...

The package has legitimate relay functionality, but its global postinstall mutates foreign Codex and Claude control surfaces, including a default agent profile. This meets the block bound...

Source inspection confirms hard-coded third-party uploads of project files and system identity data, including config files that the CLI treats as credential-bearing. The postinstall scaf...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

The package contains a concrete, concealed, remotely controlled action against the user's authenticated account during ordinary runtime. The benign lifecycle/version check and scoped medi...

The package performs unconsented postinstall mutation of a consuming project’s broad AI-agent control surface, including deletion of existing agent configuration. This meets the firewall...

The package has no install hook, but its normal runtime path performs broad, remote-updatable AI-agent control-surface mutation and executes a detached downloaded native runner. This is a...

The documented postinstall path automatically installs hooks across existing Claude Code/Codex environments, an unconsented foreign AI-agent control-surface mutation. Disclosure, opt-out...

Source confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the firewall block boundary despite the absence of observed network exfiltration. P...

Concrete default-enabled runtime data exfiltration is present in source; the absence of an install hook does not mitigate it.

The package has a concrete npm postinstall path that can mutate foreign Claude control files without affirmative consent. This meets the install-control-surface block policy despite the f...

Runtime behavior establishes concrete credential exfiltration to a package-supplied remote datastore; it is not required for a local WhatsApp bot. The preinstall hook is unrelated and doe...

Source inspection confirms the lifecycle script deploys package-controlled instructions across multiple unrelated agent platforms. This satisfies the firewall block criterion for unconsen...

Source confirms an automatic postinstall modifies foreign global Claude/Codex configuration and installs a future Codex lifecycle hook. This meets the blocking policy for unconsented inst...

Direct source inspection confirms unconsented install-time collection and external transmission of local system data. This is concrete credential/system-data exfiltration behavior.

Direct source inspection confirms install-time global AI-agent configuration changes, including a default agent routing profile. The global-only guard and loopback endpoint reduce unrelat...

The package's documented purpose does not change that npm postinstall performs unconsented writes across a broad set of foreign AI-agent configurations. This meets the blocking policy for...