npm security reports, with evidence.

This is an unconsented npm postinstall mutation of broad, foreign AI-agent control surfaces, coupled with unverified remote native payload execution and persistence. It meets the firewall...

The install hook performs concrete, unconsented mutation of broad browser/AI-agent control surfaces, not merely an explicit user-command setup. The absence of observed credential exfiltra...

Source confirms automatic upload of environment-derived secrets to a hardcoded external endpoint during ordinary GitHub Actions operation. Lack of an install hook does not remove the cred...

Source inspection confirms a concrete default path that posts rich application records to embedded external webhook receivers. This is not required by installation and no local persistenc...

This is concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, plus execution of an unpinned globally fetched package. The lifecycle behavior meets the blo...

The package contains an enabled-by-default, hardcoded external telemetry destination and routes potentially sensitive application data to it. No install hook is needed for this concrete r...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-13633 blocks this version. On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) t...

The package contains no confirmed exfiltration chain, but its automatic lifecycle hook installs executable agent instructions across unrelated AI-agent platforms. That meets the firewall...

The package has no confirmed exfiltration or remote execution, but its postinstall hook concretely and unconsentedly installs active instructions into broad third-party AI-agent control s...

Source inspection confirms the policy-blocking behavior directly in the lifecycle script. CI and opt-out guards do not make the default install-time Claude Code mutation consensual.

The shipped content shows no exfiltration or remote payload behavior, but the automatic lifecycle hook performs concrete, unconsented writes to broad third-party AI-agent instruction surf...

OpenSSF/OSV malware advisory MAL-2026-13402 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. lib/Socket/messages-send.js contains network destina...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13661 blocks this version. The package is advertised as a finance/payments adapter but on require() reaches a staged loader. `_adapter.js` reconstruc...

OpenSSF/OSV malware advisory MAL-2026-13660 blocks this version. On require() of the package, index.js loads./_polyfill.js which assembles a set of C2 hostnames from split string fragment...

OpenSSF/OSV malware advisory MAL-2026-13659 blocks this version. On require() of this package, index.js loads./_loader.js which reconstructs C2 hostnames via array-join string concealment...

OpenSSF/OSV malware advisory MAL-2026-13658 blocks this version. On require() of the package, index.js loads _support.js and lib/telemetry.js, both of which reconstruct the identifier 'ch...

OpenSSF/OSV malware advisory MAL-2026-13646 blocks this version. On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split s...

OpenSSF/OSV malware advisory MAL-2026-13633 blocks this version. On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) t...

OpenSSF/OSV malware advisory MAL-2026-13631 blocks this version. On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https...