npm security reports, with evidence.

The package has a concrete unconsented postinstall chain that alters broad AI-agent configuration, including the default Codex agent. Its otherwise package-aligned proxy behavior does not...

The package has a concrete postinstall persistence mechanism targeting ~/.codex/skills, not merely an explicit CLI setup command. Disclosure and an opt-out do not remove the unconsented l...

This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unaut...

The concrete postinstall behavior meets the block boundary: unconsented mutation of foreign/broad AI-agent control surfaces. The absence of direct exfiltration does not mitigate this inst...

The package contains a concrete, default-enabled credential upload path reachable during normal CI execution. Documentation describes a vault, but does not remove the security impact of a...

The package’s advertised proxy functionality is bundled with an automatically activated, hard-coded remote administration channel that provides command execution and unrestricted file acc...

Direct source inspection confirms an intentional browser data-exfiltration payload and deceptive UI. Lack of an install hook reduces automatic reachability but does not negate the concret...

The source contains a concrete credential- and input-exfiltration chain to a hard-coded external receiver. Lack of an install hook and explicit init call reduce automatic reachability but...

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfil...

Source inspection confirms concrete unconsented postinstall deletion and replacement of host AI-agent-related configuration. This meets the blocking policy regardless of the absence of co...

Source directly establishes default-enabled transmission of authentication secrets to a package-controlled third-party endpoint and consumption of its session response. No lifecycle hook...

This is a concrete unconsented postinstall mutation of broad, cross-vendor AI-agent control files in the consuming project. It meets the install-control-surface block boundary despite no...

This is a concrete unconsented postinstall mutation of multiple foreign, global AI-agent control surfaces. Hardened permission defaults do not remove the install-time control-surface take...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the publish-block policy regardless of the absence of exfiltration.

Source confirms an automatic postinstall path that mutates multiple third-party AI-client configurations and establishes remote native-code execution with login persistence. This meets th...

Reviewed lifecycle source confirms concrete install-time deletion and control-surface mutation in the consumer project. This meets the blocking policy regardless of the absence of observe...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, matching the block boundary. The absence of network exfiltration does not mitigate the con...

Source confirms concrete postinstall persistence across unrelated AI-agent configurations, meeting block policy. Network and cookie primitives do not reduce this independent install-time...

This is concrete default-enabled data exfiltration to a package-chosen external endpoint, not merely a user-configured integration. The absence of an npm install lifecycle hook does not m...

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, meeting the blocking policy. Explicit-user ai-trash setup does not mitigate the independent postinstal...

The lifecycle behavior is concrete and package-controlled, not a scanner-only inference. It meets the firewall block rule for unconsented postinstall mutation of broad foreign AI-agent co...