npm security reports, with evidence.

OpenSSF Malicious Packages via OSV confirms css-kfvwax-polyfill@1.0.0 as malicious (MAL-2026-17575): Malicious code in css-kfvwax-polyfill (npm)

OpenSSF Malicious Packages via OSV confirms css-nrmgzn-polyfill@1.0.0 as malicious (MAL-2026-17576): Malicious code in css-nrmgzn-polyfill (npm)

OpenSSF Malicious Packages via OSV confirms checkmate-remediation-assistant@1.0.0 as malicious (MAL-2026-17572): Malicious code in checkmate-remediation-assistant (npm)

OpenSSF Malicious Packages via OSV confirms with-cte@1.0.0 as malicious (MAL-2026-17579): Malicious code in with-cte (npm)

Inspected source proves automatic, unconsented mutation of two foreign global AI-agent control surfaces. The blocking decision rests on that lifecycle behavior, independently of scanner s...

Source proves unconsented postinstall mutation of foreign, global AI-agent control surfaces, meeting the supplied blocking policy. Package ownership of the registered server and preservat...

The inspected lifecycle chain performs automatic, unconsented writes to multiple foreign AI-agent skill directories. This meets the blocking policy for agent control-surface mutation rega...

Inspected source establishes unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the blocking policy even though the installed instructions align wi...

Inspected source establishes unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the supplied blocking policy even though the skill serves package-r...

Source confirms unconsented npm postinstall mutation of multiple foreign AI-agent control surfaces. This meets the explicit blocking policy even though the installed delegation functional...

The inspected lifecycle chain performs unconsented writes to foreign agents' global instructions. This meets the explicit blocking rule for installation-time AI-agent control-surface muta...

Inspected source establishes unconsented postinstall mutation of foreign and shared AI-agent control surfaces, which meets the blocking policy. Blocking rests on the automatic instruction...

Source establishes unconsented postinstall mutation of foreign, global AI-agent control surfaces. This meets the blocking policy regardless of the delegation feature's package alignment.

OpenSSF Malicious Packages via OSV confirms @subql/common@5.8.3 as malicious (MAL-2026-17571): Malicious code in @subql/common (npm)

Source establishes unconsented postinstall mutation of a shared Pi agent instruction file, including a user-directory fallback. This meets the blocking rule for foreign or broad AI-agent...

The source establishes an unconsented postinstall mutation of a shared AI-agent control surface, including a user-wide fallback. Under the supplied policy, this warrants blocking despite...

Source establishes an unconsented postinstall write to a shared AI-agent instruction file, including a user-wide fallback. This meets the blocking control-surface policy despite the task-...

The inspected lifecycle chain performs unconsented mutation of OpenCode's global control surface and removes unrelated global MCP packages. This independently supports blocking, regardles...

Source proves unconsented postinstall replacement of a foreign AI-agent client and mutation of its updater configuration. This meets the blocking rule for agent control hijacking despite...

Inspected source establishes an automatic postinstall chain that mutates foreign, user-wide AI-agent configurations and instructions without consent. This meets the explicit blocking poli...