npm security reports, with evidence.

The automatic postinstall chain executes an opaque installer that targets AI-agent skill infrastructure. This is unconsented lifecycle mutation of a broad foreign agent control surface.

The automatic postinstall path mutates broad AI-agent and shell control surfaces. This is concrete unconsented install-time control-surface modification.

The automatic postinstall hook performs broad user-level Claude command and skill installation rather than limiting setup to an explicit user action or a package-owned isolated surface.

The automatic postinstall writes enabled OpenCode configuration and agent content into the consuming project. This meets the install-control-surface blocking policy despite preserving an...

The package performs automatic postinstall mutation of user-scoped AI-agent skill and MCP configuration, including a launcher registration. This meets the policy definition of a concrete...

Global postinstall unconsented overwrite of Claude, Codex, shared agents, and OpenClaw-family skill directories is a broad foreign agent control-surface mutation. The skip flag and non-gl...

The postinstall hook writes this package's skills into the global Codex and Claude skill directories and prunes existing files there without a user command or consent check. That is uncon...

The package performs broad, unconsented consumer-project mutation during postinstall and installs a plugin that maintains its integration. This is concrete install-hook abuse even though...

The postinstall hook unconditionally mutates Cursor user skills and the user MCP server list, which is a foreign agent control surface, without consent. That install-time control-surface...

The active executable performs credential and local-file collection followed by a network send. Its npm command name makes the behavior especially likely to be triggered through command c...

Postinstall always writes Claude Code skill files under the user home, and after a prior setup marker it also rewrites Claude MCP and hook settings. That is unconsented install-time mutat...

The postinstall hook unconditionally mutates two foreign user-level agent skill directories, which is an unconsented broad AI-agent control-surface write. The same script also deletes non...

The active entry point contains concealed remote AI proxying and hidden prompt injection, neither of which is disclosed by the minimal package metadata. Although it has no install hook, t...

The postinstall hook writes Claude Code skills on every built install and, once local setup exists, also rewrites Claude MCP and settings hooks. That is unconsented lifecycle mutation of...

The postinstall hook unconsentingly rewrites foreign global AI-agent instruction files for Claude Code, Cursor, and Windsurf. That is a concrete control-surface hijack, not a user-invoked...

The preinstall hook unconditionally exfiltrates hostname and username to a listener and suppresses errors, which is concrete install-time data collection. A loopback URL and bug-bounty wo...

Automatic install-time host-identifier transmission to an external IP is a concrete data-exfiltration behavior. The duplicated import-time request reinforces that this is active behavior...

The package contains concrete, automatic install-hook data collection and transmission. Its loopback destination does not remove the unconsented collection behavior or the risk from a loc...

The automatic lifecycle hook gathers and transmits host identity data, while the package metadata explicitly frames the behavior as dependency confusion. This is concrete malicious instal...

The preinstall hook unconditionally harvests hostname and username and sends them over HTTP during install, with errors silenced, while presenting the package as @waves/icons. Self-descri...

The package contains a concrete preinstall data-collection and HTTP-send operation. Automatic execution during installation makes this malicious install-time behavior.