npm security reports, with evidence.

The install hook concretely writes package-controlled AI-agent instructions into foreign global agent directories. This meets the blocking policy for unconsented postinstall mutation of a...

Direct inspection confirms the lifecycle script writes package-controlled instructions into existing ~/.claude and ~/.codex installations. This meets the blocking policy regardless of the...

Direct inspection confirms the postinstall drop into ~/.claude and ~/.codex, not merely scanner inference. This meets the firewall block boundary for unconsented postinstall mutation of b...

The lifecycle hook performs an unconsented install-time mutation of existing Claude Code/Codex control surfaces. This meets the firewall blocking boundary regardless of the package’s stat...

Source inspection confirms concrete postinstall database mutation, not merely static network indicators. The limited noninteractive guard does not prevent execution when project environme...

Source directly confirms unconsented install-time collection and external transmission of local system data. This is concrete malicious exfiltration, not a benign package feature.

Source confirms an unconsented postinstall mutation of a foreign, broad AI-agent control surface. README disclosure and an opt-out do not change that automatic install-time behavior.

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, which meets the blocking policy. Remote binary execution and additional host mutations increase imp...

This is concrete, unconsented install-time collection and exfiltration of local host data to an unrelated external endpoint.

This is concrete, unconsented install-time system-information exfiltration, explicitly framed as a dependency-confusion proof of concept. The source directly establishes the behavior.

Source confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only inference.

Direct source inspection confirms unconsented install-time collection and external transmission of host data. This is concrete malicious behavior, not merely a suspicious primitive.

Direct source inspection confirms an install-time host-fingerprinting and external exfiltration chain. The nested archive contains the same package source and does not mitigate this behav...

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. This is concrete malicious behavior, not an inert test artifact.

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same manifest and source pattern.

Source directly confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same malicious manifest and script.

Source directly confirms unconsented install-time host fingerprinting and external exfiltration. The package description also identifies it as a dependency-confusion proof of concept.

Direct source inspection confirms unconsented install-time collection and exfiltration of host fingerprint data. This is concrete malicious behavior, not merely a static indicator.

The package performs unconsented install-time fingerprint exfiltration and explicitly identifies itself as a dependency-confusion proof of concept. No benign functionality offsets this co...

The package contains concrete, unconditional remote-code execution at import time. Its inert-canary documentation is contradicted by the source.

This is an import-time, targeted downloader/executor with stealth persistence, unrelated to calendar or streak math. Absence of an npm lifecycle hook does not mitigate the concrete runtim...

Despite inert-canary comments, the source contains concrete import-time remote code execution. No install hook is needed for this to be malicious.

The package has no install hook, but its exported main file creates concrete remote code execution whenever it is imported. The source comment falsely describes the package as inert.

Direct source inspection confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only signal.

Direct source inspection confirms an install-time host-fingerprinting exfiltration chain. The declared dependency-confusion proof-of-concept description reinforces malicious intent.