npm security reports, with evidence.

Source inspection confirms a postinstall hook that mutates a broad set of foreign AI-agent configuration files. This meets the install-control-surface block criterion regardless of the op...

Direct source inspection confirms a concrete, automatic postinstall AI-agent control-surface takeover. The absence of exfiltration does not mitigate the unconsented cross-tool persistence.

The lifecycle source establishes an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. This meets the blocking policy despite no observed network exfiltration.

The postinstall hook performs unconsented mutation of a broad, foreign AI-agent control surface. This meets the blocking policy regardless of the package's stated browser-automation purpose.

The concrete postinstall fan-out writes behavior-bearing assets into foreign/broad AI-agent control surfaces without explicit user invocation. This meets the install-control-surface block...

Source confirms unconsented postinstall mutation of foreign/broad AI-agent configuration surfaces. This meets the install-control-surface blocking policy despite no confirmed network exfi...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the install-control-surface blocking policy regardless of the ab...

This is concrete, import-triggered remote code execution rather than declared telemetry functionality. The lack of an install hook does not mitigate execution during ordinary use.

This is concrete import-time remote binary retrieval and execution, unrelated to the stated token-provider function. No lifecycle hook is needed because the entrypoint triggers the payloa...

Direct source inspection confirms a reachable import-time downloader and executor, not merely telemetry behavior. The lack of install hooks does not mitigate runtime execution on package...

This is an unconsented import-time staged payload chain culminating in arbitrary native code execution. The harmless-looking public API and unused telemetry source do not mitigate that co...

Source confirms default runtime transmission of rich host application records to hard-coded external webhook destinations. The benign SDK structure and lack of install-time execution do n...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The global-install guard reduces scope but does not provide consent for the configuration...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...