npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13434 blocks this version. The exported bootstrapCore() unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded c...

OpenSSF/OSV malware advisory MAL-2026-13434 blocks this version. The exported bootstrapCore() unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded c...

OpenSSF/OSV malware advisory MAL-2026-13434 blocks this version. The exported bootstrapCore() unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded c...

OpenSSF/OSV malware advisory MAL-2026-13434 blocks this version. The exported bootstrapCore() unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded c...

OpenSSF/OSV malware advisory MAL-2026-13434 blocks this version. The exported bootstrapCore() unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded c...

OpenSSF/OSV malware advisory MAL-2026-13433 blocks this version. On `npm install`, the package's `postinstall` hook runs `scripts/telemetry.js`, which collects installer-side reconnaissan...

OpenSSF/OSV malware advisory MAL-2026-13431 blocks this version. payload.js is declared as the package `main` and runs an IIFE immediately on require/import. It fetches a wordlist of Linu...

OpenSSF/OSV malware advisory MAL-2026-13431 blocks this version. payload.js is declared as the package `main` and runs an IIFE immediately on require/import. It fetches a wordlist of Linu...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

This is a concrete, unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Local-only binding and release integrity checks do not mitigate the control-surface ta...

Direct source inspection confirms unconsented postinstall writes to broad, foreign AI-agent control surfaces. This meets the blocking policy regardless of the package’s stated automation...

The concealed payload executes automatically on import and contains both network logic and dynamic detached child-process execution. This is concrete malicious behavior, not a package-ali...

The hidden import-time loader, blockchain-based C2 discovery, and remote second-stage execution are concrete malicious behavior unrelated to the package function. No lifecycle hook is req...

Source inspection confirms an import-time hidden executable with concrete backdoor, exfiltration, and persistence functionality. No install hook is needed because normal application impor...

Although activation is user-invoked rather than install-time, the package conceals a remote shell behind a health-client interface. The concrete command-and-control behavior warrants bloc...

The lifecycle path is concrete and reaches global Claude configuration and recurring command hooks. This meets the blocking policy regardless of scanner similarity labels.

Source inspection confirms the scanner’s core finding: a postinstall hook writes root-level AI-agent instruction files in the consuming project. The non-overwrite guard and absence of exf...

The postinstall behavior is concrete, automatic, and targets multiple foreign global agent configurations. This meets the blocking policy even though the package uses package-branded asse...

Source inspection confirms an unconsented postinstall mutation of a foreign AI-agent control surface. The global-install and existing-Cursor guards reduce scope but do not make the mutati...