npm security reports, with evidence.

The automatic lifecycle chain modifies a foreign AI-agent environment and installs MCP capabilities without an explicit setup command or target choice. This meets the install-control-surf...

The global postinstall chain automatically installs package-controlled agent content into the user's Claude Code configuration. This meets the install-control-surface blocking rule even t...

The package performs concrete, automatic npm lifecycle changes to a foreign AI-agent configuration and MCP control surface. This meets the install-control-surface blocking rule.

The lifecycle hook performs covert executable deployment and detached execution during installation. This is concrete malicious install-hook abuse.

The automatic postinstall hook rewrites a foreign AI coding-agent dependency rather than limiting setup to this package's own files. This meets the install-control-surface blocking condit...

The package performs unconsented postinstall writes to a foreign AI-agent control surface. Guardrails limit when the DSH patch applies but do not remove the automatic command-catalog muta...

The automatic postinstall performs both user-level agent skill installation and foreign host-file mutation. Those concrete lifecycle actions meet the blocking policy for unconsented broad...

This release performs automatic postinstall writes to a foreign AI-agent host and user-level skill catalog. That concrete control-surface mutation meets the blocking policy despite its st...

The package is a browser remote-code loader: index.html dynamically imports fetched bytes and calls boot, and sw.js importScripts a versioned CDN script. Obfuscated CDN endpoints and an e...

The Linux JDK fetch is a concrete remote-code path: an unrelated Vercel host supplies an archive that is extracted and then placed on JAVA_HOME for a later Expo command. Windows uses Adop...

The CLI unconditionally ships tool activity and other log lines to a package-controlled Loki host, with only partial secret redaction and no opt-out in the flush path. That is hidden runt...

The automatic lifecycle hook performs privileged, hidden, logon-triggered persistence and starts the persisted task. This is concrete install-time persistence rather than an explicit user...

The postinstall hook writes this package into many third-party AI skill directories and registers a second global package in their MCP configs without a separate user command. That is unc...

The common client entry loads unpinned remote code and, by default, forwards the stored PeerTube bearer token, email, and username to a package-controlled host. A fixed admin password in...

The plugin is not limited to YouTube search: every visitor page loads publisher remote code and, by default, forwards the local PeerTube session token to the publisher host, while the ser...

The package automatically modifies both Claude and Codex MCP configuration during postinstall. This satisfies the policy's concrete block condition for unconsented lifecycle mutation of f...

Both published builds embed sweetalert2 protestware that, on import in matching browsers, disables page interaction and fetches a remote audio file. That is concrete hostile behavior in t...

The active entrypoint automatically collects and exports a persistent identifier, public IP address, and usage telemetry to third parties. This is a concrete data-exfiltration surface rat...

The postinstall hook silently rewrites a foreign OpenCode control surface and installs extra global agent packages, which is unconsented agent-control mutation. Product-aligned plugin set...

The postinstall hook mutates broad, foreign AI-agent control surfaces and shell startup files without a user command, and later MCP startup continues that mutation. Silencing setup errors...

The automatic postinstall execution of an externally downloaded binary with an agent-hook installation argument is a concrete unconsented AI-agent control-surface risk. Static source does...