npm security reports, with evidence.

The automatic lifecycle hook performs broad, potentially destructive AI-agent configuration writes without an explicit user command or consent gate. This meets the install-control-surface...

The package performs an unconsented post-install mutation of a shared AI-agent control surface. This meets the install-control-surface blocking rule.

OpenSSF Malicious Packages via OSV confirms chai-as-indexed@7.2.8 as malicious (MAL-2026-16293): Malicious code in chai-as-indexed (npm)

The runtime bundle hides a year check that throws an empty error after 2026 and aborts module initialization, which is a concrete protestware time bomb. No install hook or data theft was...

The published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that c...

The postinstall hook unconditionally mutates the user-global Claude Code settings file and installs a command Claude executes for every session. That is an unconsented install-time change...

The npm postinstall hook unconditionally starts a global Claude config write when the install is global, outside CI, and not opted out. That write changes ~/.claude settings and enables a...

The postinstall path automatically mutates OpenCode, Grok, Hermes, OpenClaw, and Cursor control files and reuses a local Cursor daemon token. That is concrete unconsented install-time hij...

The package contains an active remote-script execution path driven by a service request, not merely a configurable API client or inert payload. The lack of an install hook does not remove...

Unconsented postinstall mutation of the global Claude Code hook surface is a foreign agent control-surface write, not an explicit user setup command. Empty matchers make the injected comm...

The published node is fully obfuscated and, on import, runs a concealed Go WebAssembly payload after exposing Node filesystem and OS APIs to it. That is hidden code execution in the host...

Postinstall on a global install unconditionally launches plugin install, and that command defaults to mutating Claude, Codex, and Cursor user configuration together. That is an unconsente...

OpenSSF Malicious Packages via OSV confirms @nubjs/types@0.9.4 as malicious (MAL-2026-17186): Malicious code in @nubjs/types (npm)

The automatic lifecycle prompt is directed at an AI and chains to broad local agent configuration writes. This is an unconsented install-time AI-agent control-surface modification path.

The package automatically exfiltrates host and CI metadata from its active configuration entrypoint to an unrelated endpoint. This is concrete malicious data collection rather than config...

The lifecycle hook performs broad AI-agent configuration mutation and automatic plugin installation. This is a concrete install-hook abuse chain, not an explicit user-invoked setup flow.

The main callable path reaches deliberately concealed dynamically constructed code. This is concrete active malicious behavior, even though the concealed payload's final actions are not s...

The package combines security-control weakening with unauthenticated remote command execution. This is concrete malware behavior, not a benign installer capability.

Handshake and socket setup silently follow channels from operator-controlled GitHub JSON and stamp media with a fixed newsletter, using the victim's WhatsApp session. The obfuscation and...

The package silently uses the authenticated WhatsApp session to follow newsletters supplied by an obfuscated third-party URL, which is concrete malicious session abuse. There is no instal...

The package contains a concealed, automatically activated remote-control path that drives authenticated WhatsApp activity. This is concrete malicious runtime behavior, despite the absence...