npm security reports, with evidence.

The automatic postinstall hook makes persistent changes to foreign AI-agent configuration rather than limiting integration to an explicit command or package-owned location. This is concre...

The main module is an import-time loader that stealthily executes a fixed disguised executable path after waiting for a companion dependency to place it. That behavior is unrelated to the...

The published entrypoint itself launches a concealed executable from a fixed user-profile path, independent of the documented binary runner API. That import-time hidden spawn is concrete...

The automatic lifecycle chain forcibly writes package-controlled instructions into multiple third-party AI-agent directories. This meets the install-control-surface blocking policy.

The automatic postinstall mutation of the user's global Codex configuration is an unconsented change to a broad AI-agent control surface. This meets the install-control-surface blocking p...

The automatic post-install hook mutates broad, foreign AI-agent control surfaces and registers executable MCP servers. This is concrete unconsented lifecycle control-surface modification.

The import-triggered, heavily obfuscated command execution and outbound request are concrete malicious behavior. Absence of an install hook does not remove the runtime attack surface.

The automatic postinstall hook performs unconsented mutation of a broad AI-agent control surface, including global package installation and enabled agent configuration. This meets the ins...

The package contains an active remote-code loader embedded into a newly deployed Lambda function. Its opaque, service-controlled payload is executed without integrity verification.

This is an active remote-code execution path in a customer AWS function, not merely a downloadable artifact. Explicit deployment invocation does not constrain the package-controlled endpo...

The package contains an automatic preinstall hook that harvests machine identity fields and sends them over HTTP. This is concrete install-hook abuse and is not necessary for the declared...

Automatic collection and transmission of host identity data during preinstall is concrete install-hook abuse. The package's dependency-confusion framing reinforces malicious intent.

This package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable instal...

The package contains an automatic preinstall hook that collects and sends local identifiers. This is concrete install-hook abuse, not required behavior for the declared module.

The package contains an active install-time remote payload execution chain, rather than a user-invoked download. This warrants blocking because the downloaded native code is executed auto...

The automatic lifecycle hook mutates third-party agent-plugin code and redirects its configuration under the package's namespace. Source-map removal further conceals the resulting install...

The package executes a persistent OpenCode configuration change automatically at install time, rather than through an explicit user command. This is concrete AI-agent control-surface hija...

The lifecycle hook performs automatic, non-interactive modification of a foreign AI-agent configuration directory. This meets the install-control-surface blocking criterion even though no...

The automatic lifecycle chain changes consumer package-manager settings and broad AI-agent control surfaces, then installs a Git hook. This meets the policy threshold for an unconsented i...

The package has a postinstall hook that modifies broad, foreign AI-agent control surfaces in the user's home directory. This meets the install-control-surface blocking rule even though no...

The package exports a local service credential to a fixed unrelated external recipient by default, which is concrete credential exfiltration. Embedded administrator credentials add a sepa...