npm security reports, with evidence.

Postinstall automatically mutates project and user-home agent control files for Hermes, OpenClaw, OpenCode, and Cursor, including enabling a Hermes plugin. That is unconsented foreign con...

The automatic lifecycle hook combines credential harvesting, internal reconnaissance, service-data collection, and exfiltration to an unrelated hard-coded endpoint. This is concrete malic...

Postinstall unconditionally deploys Cursor hooks, rules, skills, and commands into the consumer project, which is an unconsented mutation of a foreign agent control surface. Optional MCP...

Account startup silently uploads IMAP configuration, including the password field, to the hardcoded host rmf39.aaz.lt. That is a default credential export to a package-controlled recipien...

The only runtime file immediately redirects the browser to a package-chosen webhook.site URL with document.cookie appended, using split strings to hide the sink. That is active cookie exf...

The install lifecycle unconditionally invokes an installer whose stated effect is writing skills into multiple third-party agent hosts. That is unconsented postinstall mutation of a broad...

OpenSSF Malicious Packages via OSV confirms oracle-redis@5.11.3 as malicious (MAL-2026-16390): Malicious code in oracle-redis (npm)

OpenSSF Malicious Packages via OSV confirms noverojava@1.1.0 as malicious (MAL-2026-16389): Malicious code in noverojava (npm)

OpenSSF Malicious Packages via OSV confirms noverojava@1.0.9 as malicious (MAL-2026-16389): Malicious code in noverojava (npm)

An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That...

The automatic postinstall hook silently replaces consumer-project Claude Code skills, which is concrete install-hook abuse under the supplied policy. The behavior warrants blocking even t...

The postinstall hook mutates project and user-home AI agent control files for OpenCode, Cursor, Hermes, and OpenClaw without a separate user command. That is unconsented install-time cont...

Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfil...

Load-time execution in the main and CLI bundles extracts a concealed command from a bundled JPEG and runs it through hidden PowerShell, which is a concrete remote-code dropper. The readab...

The install script and package entry are wired to an obfuscated probe that DNS-resolves a hostname containing the username, hostname, and directory name to oob.algamil7x.xyz. That is inst...

The install hook and package entry load obfuscated code that DNS-exfiltrates host and directory identity to oob.algamil7x.xyz. The web-component exports do not account for that hidden loo...

The postinstall hook automatically runs a broad plugin install into Claude, Codex, and Cursor user configuration during a global package install. That is unconsented lifecycle mutation of...

A global npm postinstall automatically installs this package's plugin into Claude, Codex, and Cursor and rewrites the user Codex config, which is an unconsented broad agent control-surfac...

The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diag...

Unconsented postinstall mutation of user-global ~/.claude/settings.json enables prompt and tool-content export to a package-controlled collector. That is an active agent-control hijack, n...

Global postinstall unconditionally mutates foreign, broad agent control surfaces, including Cursor, Claude, and Codex config, command, and skill files. That is unconsented install-time ag...