npm security reports, with evidence.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces (.kiro and .cursor). The absence of exfiltration does not remove that install-time control-surface...

Source inspection confirms an install-time write to `.kiro/steering` and `.cursor/rules`; this meets the policy's concrete foreign AI-agent control-surface mutation boundary. No separate...

Source confirms a concrete sensitive-data exfiltration path and a misleading privacy claim. Absence of lifecycle execution reduces reach but does not negate the behavior.

The package performs concrete, unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the blocking policy regardless of the absence of observed exfiltr...

Source confirms the prohibited chain directly: npm postinstall invokes a non-interactive bootstrap that writes cross-vendor AI-agent controls in the consuming project. No exfiltration is...

The postinstall lifecycle script performs a concrete, unconsented mutation of Claude Code's global hook configuration. The binary-presence guard limits activation but does not make the in...

This is concrete unconsented postinstall mutation of a broad Claude Code control surface. No install-time exfiltration was found, but the lifecycle behavior meets the block boundary.

This is a concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, coupled with remote executable installation and persistence. The guards do not establish...

This is a concrete postinstall chain from remote retrieval to mutation of broad project AI-agent control surfaces. The key guard limits reach but does not make the install-time mutation u...

This is a concrete, unconsented remote-controlled mutation of the consumer's authenticated WhatsApp account, not package-aligned messaging functionality. The install hook itself is benign...

The behavior is source-confirmed and install-triggered, not merely an explicit setup command. API-key and workspace prerequisites reduce reachability but do not remove the concrete broad...

The third-party credential submission is enabled by the default API-server setting and reached by the package's automatic recovery path. No install hook is needed for this runtime credent...

This is a concrete unconsented postinstall mutation of a foreign project and its AI-agent configuration. Although the content is package-aligned and no exfiltration was found, the install...

Source establishes a reachable, default-enabled credential-exfiltration path with no redaction. Absence of lifecycle hooks does not mitigate runtime export of authentication secrets.

Direct source inspection confirms the scanner's critical finding. This meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Direct source inspection confirms unconsented install-time mutation of broad/foreign AI-agent control surfaces. This meets the firewall block boundary even though the hook does not itself...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. Lack of observed network exfiltration does not remove the in...

Source confirms the scanner finding: the lifecycle hook changes multiple user-level AI-agent skill roots rather than requiring an explicit setup command. This meets the firewall block pol...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution during normal use.

The package contains a reachable import-time downloader/executor, not just telemetry primitives. The absence of install hooks does not mitigate execution on normal use.

Source inspection confirms an import-triggered remote binary download and execution chain in _bridge.js. No lifecycle hook is needed because index.js invokes it at runtime.

The import-time loader implements concrete, unauthenticated remote binary execution. This is malicious behavior independent of the lack of npm lifecycle hooks.

This is a concrete import-time remote code execution chain, not ordinary telemetry: remote binary bytes are executed without authentication. The absence of an npm lifecycle hook does not...

The package contains concrete, reachable remote payload execution on import. The absence of an install hook does not mitigate this runtime compromise.

This is a concrete import-time remote-code-execution chain unrelated to the minimal exported SDK. The absence of npm lifecycle hooks does not mitigate runtime execution on ordinary use.