npm security reports, with evidence.

Source confirms unconditional chat-content transmission under a vendor account key, contrary to the documented local/opt-in sync behavior. The harmless preinstall hook does not mitigate t...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, accompanied by persistence. Localhost binding does not remove the control-hijack risk becaus...

Source inspection confirms a concrete postinstall write into Codex's global skills directory. That behavior meets the firewall block boundary regardless of otherwise package-aligned API a...

The lifecycle behavior meets the block boundary: npm postinstall mutates multiple foreign global AI-agent control surfaces without an explicit user setup command. Lack of download/exfiltr...

The concrete install-time writes to multiple foreign global AI-agent control surfaces meet the blocking policy. Hardened OpenCode permission defaults do not remove the unconsented lifecyc...

The package’s automatic postinstall performs broad, persistent AI-agent control-surface writes outside the consuming project. This meets the blocking policy regardless of the absence of o...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The absence of observed install-time exfiltration does not remove that block-level behavior.

The automatic cross-host agent-control mutations meet the install-control-surface blocking rule. Lack of observed exfiltration does not remove that concrete install-time persistence/contr...

Direct source inspection confirms unconsented postinstall mutation of several global AI-agent control surfaces. This meets the install-control-surface block criterion regardless of benign...

Source inspection confirms unconsented postinstall mutation of several foreign global AI-agent control surfaces, which meets the blocking policy. The token-handling runtime path further i...

The concrete postinstall mutation of broad, foreign AI-agent control surfaces meets the block boundary. Hardened OpenCode defaults and lack of observed exfiltration do not remove the unco...

The lifecycle behavior is a concrete unconsented cross-vendor AI-agent control-surface mutation, meeting the blocking policy. No separate exfiltration chain is needed for this verdict.

The external logging endpoint receives account configuration during ordinary runtime initialization, including a JSON serialization of IMAP settings. No lifecycle hook is needed for this...

The package contains a concrete automatic credential-exfiltration path, not merely suspicious primitives or a user-invoked integration. The benign postinstall hook does not mitigate the r...

Source inspection confirms an import-reachable opaque payload with dynamic execution and host/network-capable primitives, not merely scanner labeling. Absence of lifecycle hooks does not...

The delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.

The package contains a concrete default-on exfiltration path to hardcoded external webhook receivers, not merely a generic request utility. No install hook is involved, but runtime use ex...

Source inspection confirms concrete staged remote execution and detached process launch, not merely suspicious primitives. Absence of lifecycle hooks does not mitigate import-time execution.

Source confirms automatic collection and remote transmission of raw command input, not merely network use for the advertised challenge service. The lack of install hooks limits installati...

The source confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. Safety checks and lack of network exfiltration do not remove that concrete persistence...