npm security reports, with evidence.

Source inspection confirms a concealed remote-code-execution path in src/index.cjs. It is not install-time, but it is concrete malicious functionality rather than a package-aligned feature.

The native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-tim...

Direct inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.

Direct source inspection confirms runtime cookie exfiltration to external endpoints; no install hook is required for the malicious behavior.

Concrete source shows automatic, suppressed transmission of mail/account-related logs to an unrelated remote endpoint. The benign workspace-only postinstall hook does not mitigate this ru...

Despite no npm lifecycle hook, the default import path performs concealed, import-time cross-platform startup persistence by dropping a native executable. This is concrete malicious behav...

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. Absence of exfiltration does not remove the persistent prompt/control hijack risk.

Source inspection confirms a runtime path that silently transmits user credential-bearing configuration to a non-service logging endpoint. This is concrete credential exfiltration, not me...

This is a concrete unconsented postinstall mutation of a generic host AI-agent directory, not merely an explicit CLI setup command. No additional exfiltration behavior was found, but the...

Source inspection confirms concrete postinstall mutation of global OpenCode and ~/.agents control surfaces, exceeding first-party project setup. The absence of exfiltration does not mitig...

This is concrete, runtime-reachable credential/data exfiltration rather than a benign scanner primitive. The install hook itself is benign, but it does not mitigate the Android payload.

The source establishes a direct runtime path from IMAP configuration to a third-party logging URL; it is not required for the claimed storage functionality. No lifecycle hook is needed fo...

Source establishes a concrete credential-exfiltration chain triggered by an ordinary product command and persisted through its worker. The authentication precondition does not provide inf...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The subsequent plugin behavior compounds the risk through aut...

The package contains default, active external webhook endpoints and sends rich runtime records to them automatically. No install hook is present, but the runtime exfiltration behavior is...

This is a concrete unconsented postinstall mutation of foreign project-root AI-agent control files. Per policy, that lifecycle behavior warrants blocking even though no exfiltration was f...

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not mere...

This is concrete credential harvesting and remote exfiltration from a separate application's secret store, automatically coupled to an ostensibly local usage-start action. Authentication...

Source inspection confirms an unconsented postinstall mutation of ~/.claude.json and ~/.codex/config.toml. This meets the blocking AI-agent control-hijack boundary regardless of the scann...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote binary execution and broad host changes. It meets the firewall block policy ir...

The package contains a concrete, unconsented postinstall mutation of broad AI-agent control surfaces, including a persistent Codex lifecycle executable. This meets the install-control-sur...

This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.

This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.

Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.

This is more than a benign scanner primitive: source confirms remotely supplied executable hook replacement in a broad AI-agent control surface, plus interception and concealment of agent...