npm security reports, with evidence.

Source confirms concrete postinstall persistence across unrelated AI-agent configurations, meeting block policy. Network and cookie primitives do not reduce this independent install-time...

This is concrete default-enabled data exfiltration to a package-chosen external endpoint, not merely a user-configured integration. The absence of an npm install lifecycle hook does not m...

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, meeting the blocking policy. Explicit-user ai-trash setup does not mitigate the independent postinstal...

The lifecycle behavior is concrete and package-controlled, not a scanner-only inference. It meets the firewall block rule for unconsented postinstall mutation of broad foreign AI-agent co...

The automatic postinstall mutation of foreign AI-agent skill directories is a concrete unconsented control-surface write. Source inspection found no remote payload fetch, but that does no...

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

This is concrete import-time staged payload execution, not normal telemetry: the downloaded bytes are executed without signature or hash verification. The absence of lifecycle hooks does...

Direct inspection confirms an npm postinstall mutates the foreign global Claude Code control surface and installs persistent hooks. The prior-setup guard limits reach but does not establi...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. No exfiltration is needed for this verdict.

The install hook concretely performs unconsented, broad foreign AI-agent control-surface writes. The absence of lifecycle network exfiltration does not remove this policy-defined blocking...

The package has a concrete install-time, unconsented mutation of broad foreign AI-agent control surfaces. Although no credential exfiltration or remote payload was found, this behavior me...

Concrete source shows unconsented postinstall mutation of a consuming project's package.json and Cursor rules. This meets the firewall block policy regardless of the absence of network ex...

Source inspection confirms concrete install-time OpenClaw control-surface changes and gateway exposure. The OpenClaw-presence guard does not establish user consent.

This is an unconsented postinstall mutation of a foreign AI-agent control surface and includes recursive replacement of its destination. No exfiltration is needed for this concrete contro...

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces. The lack of installer exfiltration does not mitigate the persistence and control-surface hi...

This is a concrete postinstall mutation of broad, foreign AI-agent control surfaces, compounded by automatic persistence. Safeguards and lack of observed exfiltration do not establish con...

The package’s primary assets appear package-aligned, but its automatic postinstall performs broad, active AI-agent and MCP configuration changes in every consuming project. That concrete...

The install hook performs unconsented mutation of broad, foreign AI-agent skill control surfaces. This meets the blocking policy even though the inspected installer shows no separate exfi...

Direct source inspection confirms unconsented postinstall mutation of a broad AI-agent control surface and a concrete token-bearing outbound flow. These exceed a same-vendor setup shim an...

Source directly establishes default remote telemetry and unredacted credential-bearing command arguments. This is concrete credential exfiltration, not merely a suspicious primitive.

This is concrete default credential exfiltration, not merely legitimate command telemetry: secrets accepted as CLI options are forwarded without filtering to an external analytics host. N...