npm security reports, with evidence.

The runtime MCP service is package-aligned, but its postinstall hook silently patches a third-party OAuth consent control surface. That install-time mutation is concrete and can extend be...

The package performs a concrete, automatic postinstall mutation of the consuming project's broad Claude Code extension and instruction directories. This meets the blocking policy even tho...

Source confirms an unconsented postinstall mutation of broad third-party AI IDE configuration and instruction surfaces. This meets the install-control-surface blocking policy despite no o...

Source confirms the scanner finding: lifecycle code automatically writes host MCP configuration and enables a host Git hook. This meets the firewall block boundary regardless of the absen...

Direct source inspection confirms unconsented postinstall mutation of a consumer project’s broad AI-agent control surface and persistent Git configuration. The overwrite guard does not mi...

This meets the block boundary: an npm postinstall mutates a foreign host project’s AI/MCP configuration and activates a Git hook. Lack of a confirmed network exfiltration path does not re...

The lifecycle script performs unconsented postinstall mutation of the foreign, user-wide Claude Code hook surface. Its conditional binary lookup does not make the automatic persistent hoo...

Direct inspection confirms an unconditional postinstall write to a foreign, user-wide AI-agent MCP configuration. This meets the install-time agent-control-hijack block boundary.

This is concrete import-time execution of a bundled backdoor with credential theft, persistence, exfiltration, and remote payload capabilities. Absence of an install hook does not reduce...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global Codex control-surface mutation meets the firewall block boundary.

Source confirms unconsented postinstall mutation of a consumer AI-agent control surface, not merely an explicit user setup command. This meets the blocking policy despite idempotence and...

The shared hardcoded database is not needed for local bot operation yet receives WhatsApp authentication material. This is concrete credential exfiltration/persistence, not merely a noisy...

Source confirms a hard-coded remote control plane can deliver executable definitions and receive environment secrets during normal CI CLI execution. This is concrete malicious-capable beh...

Direct inspection confirms the package performs the policy-defined blocking behavior: npm postinstall mutates multiple foreign AI-client control surfaces without an explicit user setup co...

Direct inspection confirms a reachable prompt-based control override in the bundled runtime. Absence of an install hook or confirmed credential exfiltration does not remove this runtime a...

The postinstall hook concretely performs unconsented mutation of a consumer project's Claude skills, including destructive replacement. This meets the install-time foreign AI-agent contro...

The lifecycle hook concretely mutates multiple foreign agent skill directories without an explicit setup command or install-time consent. This meets the install-control-surface block boun...

The documented behavior is intentionally implemented, but it meets the block policy: unconsented postinstall mutation of foreign AI-agent control files and consumer build scripts. No exfi...

This is a concrete unconsented postinstall mutation of foreign, repository-level AI-agent control files. The absence of exfiltration does not remove the install-time control-surface risk.

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, which meets the blocking policy. Other observed network and hook features are not needed for the verdict.

Source inspection confirms a concrete runtime exfiltration path, including potential IMAP credentials, to an external logging endpoint. No lifecycle hook is involved, but the credential-b...