npm security reports, with evidence.

The postinstall hook performs unconsented mutation of foreign/broad AI-agent skill surfaces. That concrete lifecycle behavior meets the blocking policy even though no credential exfiltrat...

This is concrete import-time remote code execution with obfuscated endpoints and no user-directed feature activation. The absence of npm lifecycle scripts does not mitigate runtime compro...

Source inspection confirms a concrete import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate malicious runtime behavior.

The import-time bridge provides a concrete, stealthy remote code-execution chain unrelated to the advertised SDK. The absence of lifecycle hooks does not mitigate execution during normal...

This is an import-time remote-code-execution loader unrelated to the documented SDK API. The opaque payload source, DNS fallback, concealed host construction, and detached execution estab...

The package establishes a persistent system service during postinstall and hides the implementation with heavy obfuscation. This is concrete malicious install-time persistence.

The declared entrypoint performs concrete, automatic remote payload execution at import time. No install hook is needed for this to be a malicious RCE chain.

This is concrete import-time remote code execution, not aligned with the advertised highlighted-text module. Lack of lifecycle scripts does not mitigate execution on normal use.

This is a concrete import-time remote payload execution chain unrelated to the advertised SDK. The absence of install hooks does not mitigate execution when an application imports the pac...

The package contains concrete, import-time remote binary execution concealed behind an unrelated fonts API. This is a direct malware execution chain, not normal telemetry.

The package’s public import path contains a concealed, remote payload execution chain unrelated to its stated adapter API. This is concrete malware behavior despite the absence of npm lif...

Direct source inspection confirms a concealed postinstall remote payload loader and arbitrary dynamic execution. This is concrete malicious install-time behavior.

This is a concrete install-time remote-code-execution chain, not required package functionality. Detached execution and obfuscation make the behavior covert.

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

Concrete runtime conversation exfiltration contradicts the documented opt-in cloud-sync behavior. The preinstall hook is benign, but does not mitigate the runtime data-transfer chain.

The global-install guard limits scope but does not obtain user consent or prevent modification of the default Codex agent and shared host configuration. This meets the install-time foreig...

This is a concrete, unconsented postinstall mutation of foreign/broad AI-agent control surfaces. Localhost-only networking does not mitigate the install-time agent configuration changes.

This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, coupled with an unverified remote native-payload chain and persistence. The guards and careful...