npm security reports, with evidence.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. No separate credential-exfiltration chain is needed for this verdict.

Direct source inspection confirms a postinstall chain that writes broad third-party agent control files and persistent Git hooks in the parent project. This meets the firewall block bound...

Source establishes a concrete, automatic, unauthorized account mutation on the ordinary runtime path, with a remotely controllable target list. The benign preinstall version check does no...

Direct source inspection confirms an unconsented install-time data-exfiltration chain. The package has no apparent functional implementation beyond this behavior.

The install hook performs an unconsented, externally sourced mutation of a broad AI-agent control surface. This meets the install-control-surface block policy.

The package contains a concrete runtime credential-exfiltration path to an unrelated host. Absence of lifecycle hooks does not mitigate this user-runtime attack.

Source inspection confirms concrete install-time collection and local persistence rather than a scanner-only match. The absence of networking limits impact but does not remove the unconse...

Source inspection confirms a postinstall side effect that collects local metadata and writes it outside the package, aligned with the package's dependency-confusion PoC description. Absen...

Direct inspection confirms an automatic postinstall collector and file write; the benign runtime entrypoint does not mitigate that install-time behavior. No network transmission was found.

This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not...

Source inspection confirms the lifecycle payload and its local metadata collection/write behavior. The benign runtime entrypoint does not mitigate the install-time action.

Direct inspection confirms a reachable obfuscated npm-install-and-execute path in index.js. The absence of install hooks limits automatic activation but does not remove the concrete runti...

The advertised SVG-fetching purpose does not justify executing arbitrary code returned by an unrelated hard-coded host. This is a concrete remote-code-execution payload path despite lacki...

The package implements a remotely controlled execution and file-management agent against an unrelated hardcoded endpoint. Although it has no install hook and requires runtime activation,...

The package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.

Source directly confirms automatic collection of identifiable workspace/activity data and persistence to a fixed external Redis sink. This is a concrete, unconsented data-exfiltration cha...

The lifecycle behavior is concrete source code, not a scanner inference. It meets the firewall block policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Direct source inspection confirms automatic, undisclosed collection routed to an embedded third-party credential rather than a host-owned endpoint. This is concrete exfiltration behavior,...

This is concrete, automatic cross-host telemetry exfiltration to a hard-coded third-party store, not merely optional host-configured storage. The embedded credential makes the collection...

This is not a benign logger/middleware implementation: its entrypoint activates an opaque payload with credential-targeting, networking, and execution capabilities. The lack of an install...

The package performs no location-related function; its install hook exists to transmit a machine identifier through DNS. This is concrete install-time data exfiltration.

Source establishes a reachable runtime credential-exfiltration chain to an unrelated host. The benign workspace-only postinstall hook does not mitigate it.

The package contains concrete, unconditional telemetry-style exfiltration to a non-package-aligned host, with no consent gate or redaction. Its benign install hook and locally scoped MCP...

This is concrete, automatic transmission of email-client runtime data to an unrelated remote logging endpoint. The benign lifecycle hook and localhost MCP design do not mitigate that exfi...

The package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint...