npm security reports, with evidence.

The package has no install hook, but its active browser entrypoint automatically executes a remotely hosted, mutable JavaScript payload. This is concrete remote code execution exposure ra...

OpenSSF Malicious Packages via OSV confirms tlxbnhd@0.0.1 as malicious (MAL-2026-16385): Malicious code in tlxbnhd (npm)

OpenSSF Malicious Packages via OSV confirms tldriver@0.0.1 as malicious (MAL-2026-16384): Malicious code in tldriver (npm)

OpenSSF Malicious Packages via OSV confirms mxdriver@0.0.2 as malicious (MAL-2026-16383): Malicious code in mxdriver (npm)

OpenSSF Malicious Packages via OSV confirms mxdriver@0.0.1 as malicious (MAL-2026-16383): Malicious code in mxdriver (npm)

The automatic postinstall performs unconsented, overwrite-enabled mutation of broad AI-agent control surfaces. This is concrete install-hook abuse under the stated policy.

This is concrete, unconsented postinstall mutation of foreign and machine-level AI-agent control surfaces. The lifecycle hook abuse warrants blocking even without demonstrated credential...

The automatic postinstall modifies a foreign, user-level Claude Code configuration and enables export-oriented telemetry for prompts, responses, and tool details. This is concrete install...

This is an unconsented automatic install-time mutation of foreign AI-agent control surfaces. The opt-out and name check do not change that the deletion is triggered by installation.

The package performs destructive, broad consumer-project mutation from an automatic install hook. This is a concrete unconsented install-time attack surface even though the inspected hook...

Postinstall unconditionally mutates the global Claude Code settings file to export prompt and tool content to a package-controlled collector. That is unconsented install-time control of a...

The install hook writes this package into several unrelated AI-agent skill directories and turns on a Codex plugin without a user command. That is an unconsented install-time takeover of...

The install hook unconditionally plants skills in Claude's home config and, when other agent directories exist, writes those control surfaces too, including enabling a Codex plugin and MC...

Unconsented postinstall rewrites the user-wide Claude Code control file and turns on prompt and tool export to a package-controlled collector. A later explicit CLI install does not author...

postinstall unconditionally installs skills into a wide set of home AI-agent directories, which is unconsented mutation of a foreign and broad agent control surface. The JavaScript shows...

A shortened, redirected remote payload piped to Bash is a concrete remote-code-execution sink. Its placement in a work-time command makes the behavior deceptive and malicious.

OpenSSF Malicious Packages via OSV confirms cisco-github-simple@1.0.1 as malicious (MAL-2026-16381): Malicious code in cisco-github-simple (npm)

OpenSSF Malicious Packages via OSV confirms chai-logger@3.0.2 as malicious (MAL-2026-16380): Malicious code in chai-logger (npm)

The install lifecycle loads obfuscated probe code that sends username, hostname, and directory labels through DNS to oob.algamil7x.xyz. That is install-time data exfiltration, independent...

The install lifecycle unconditionally launches a binary whose documented job is to modify Codex and Claude Code hooks, skills, and a Codex setting. That is unconsented postinstall mutatio...

The active remote control path evaluates received JavaScript and exposes unrestricted host RPC. This is concrete remote code execution, not merely a configurable client capability.