npm security reports, with evidence.

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, which meets the blocking policy. The local MCP implementation does not mitigate the insta...

The automatic global postinstall materially alters third-party agent skill directories, rather than merely preparing this package. The skip flag and marker checks do not provide user cons...

Source confirms an unconsented npm postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking install-control-surface policy independently of the telemetry c...

This is a concrete, unconsented postinstall mutation of a broad AI-agent control surface, with remote code execution in the same lifecycle. Documentation and defensive settings parsing do...

Source inspection confirms a concrete, automatic postinstall mutation of foreign/broad AI-agent instruction files. Under the install-control-surface policy, this is blocking even though n...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, compounded by remote code execution from a mutable main-branch URL. Documentation does not...

Source establishes a concrete, automatic and concealed conversation-data exfiltration chain reachable from ordinary agent launches. It is not install-time behavior, but it is malicious ru...

This is a concrete unconsented npm postinstall mutation of broad foreign AI-agent control surfaces. The lifecycle hook also introduces unpinned remote instructions into those surfaces.

Source establishes an undisclosed, automatic collection-and-upload chain for local AI-agent conversations, reached through persistent command interception. This is concrete data exfiltrat...

Direct source inspection confirms unconsented postinstall persistence across broad third-party AI-agent control surfaces. This meets the blocking policy regardless of the package’s stated...

OpenSSF/OSV malware advisory MAL-2026-11502 blocks this version. On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device...

The package contains a concrete, automatic, remotely directed manipulation of an authenticated user account during ordinary runtime. Its benign Node-version preinstall check does not miti...

This is a concrete, concealed, remotely controlled action on the user’s WhatsApp account. It is not required for the package’s stated messaging API purpose.

This is a concrete, remote-controlled, unauthorized account-action chain at normal runtime. The lifecycle hook itself is benign, but does not mitigate the runtime behavior.

This is a concrete import-time remote code execution chain with stealthy payload delivery and execution. It is not required for the documented library API.

The package contains a concrete remote-code-execution chain, not merely service-worker registration logic. The fetched script is executed in Node via eval with no origin or integrity vali...

OpenSSF/OSV malware advisory MAL-2026-11501 blocks this version. The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instan...

The source establishes an unconsented postinstall chain that changes multiple global AI-agent control surfaces and pulls additional tooling. This meets the blocking policy regardless of t...

The automatic, overwrite-capable postinstall mutation of third-party AI-agent control surfaces is a concrete blocked control-hijack behavior. No separate exfiltration or network payload w...

Source confirms the scanner finding: this is an unconsented postinstall chain that modifies multiple foreign AI-agent configurations and establishes persistence. That meets the firewall b...

The lifecycle hook performs the concrete foreign workspace AI-agent mutation prohibited by policy; no user command is required. Lack of exfiltration does not mitigate that install-time co...

The package performs concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces and establishes login persistence. Its stated product purpose does not remove th...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces (.kiro and .cursor). The absence of exfiltration does not remove that install-time control-surface...

Source inspection confirms an install-time write to `.kiro/steering` and `.cursor/rules`; this meets the policy's concrete foreign AI-agent control-surface mutation boundary. No separate...

Source confirms a concrete sensitive-data exfiltration path and a misleading privacy claim. Absence of lifecycle execution reduces reach but does not negate the behavior.