npm security reports, with evidence.

Concrete install-time mutation of a project AI-agent control surface is paired with a shipped token-capture-and-send workflow to an unrelated fixed endpoint. This meets the blocking thres...

Source confirms unconsented install-time mutation of Codex's global provider and default-agent control surface. That concrete behavior meets the blocking policy despite the loopback endpo...

This is a concrete, unconsented postinstall mutation of a broad foreign AI-agent control surface. The declared feature does not remove the installation-time control-hijack risk.

Source confirms a credential-bearing request to a hardcoded non-Facebook host, including an automatic runtime path. The lack of install hooks does not mitigate this concrete credential-ex...

The package has a concrete unconsented postinstall chain that alters broad AI-agent configuration, including the default Codex agent. Its otherwise package-aligned proxy behavior does not...

The package has a concrete postinstall persistence mechanism targeting ~/.codex/skills, not merely an explicit CLI setup command. Disclosure and an opt-out do not remove the unconsented l...

This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unaut...

The concrete postinstall behavior meets the block boundary: unconsented mutation of foreign/broad AI-agent control surfaces. The absence of direct exfiltration does not mitigate this inst...

The package contains a concrete, default-enabled credential upload path reachable during normal CI execution. Documentation describes a vault, but does not remove the security impact of a...

The package’s advertised proxy functionality is bundled with an automatically activated, hard-coded remote administration channel that provides command execution and unrestricted file acc...

Direct source inspection confirms an intentional browser data-exfiltration payload and deceptive UI. Lack of an install hook reduces automatic reachability but does not negate the concret...

The source contains a concrete credential- and input-exfiltration chain to a hard-coded external receiver. Lack of an install hook and explicit init call reduce automatic reachability but...

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfil...

Source inspection confirms concrete unconsented postinstall deletion and replacement of host AI-agent-related configuration. This meets the blocking policy regardless of the absence of co...

Source directly establishes default-enabled transmission of authentication secrets to a package-controlled third-party endpoint and consumption of its session response. No lifecycle hook...

This is a concrete unconsented postinstall mutation of broad, cross-vendor AI-agent control files in the consuming project. It meets the install-control-surface block boundary despite no...

This is a concrete unconsented postinstall mutation of multiple foreign, global AI-agent control surfaces. Hardened permission defaults do not remove the install-time control-surface take...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the publish-block policy regardless of the absence of exfiltration.

Source confirms an automatic postinstall path that mutates multiple third-party AI-client configurations and establishes remote native-code execution with login persistence. This meets th...

Reviewed lifecycle source confirms concrete install-time deletion and control-surface mutation in the consumer project. This meets the blocking policy regardless of the absence of observe...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, matching the block boundary. The absence of network exfiltration does not mitigate the con...