Eighteen flagged agent packages still install from npm weeks after the feeds listed them

The spawn line carries no payload of its own. `--dangerously-skip-permissions` is a flag on a program the developer installed deliberately, and the package contributes only a socket to a hardcoded server plus a loop that feeds received task objects into that flag ^[10][12]. Capability comes from the host side: a process holding the developer's credentials that can read any file, run any command and reach any network endpoint ^[9]. This ships a string ^[8]. Eight of the named packages carry that pattern verbatim, according to the post ^[11][2].

The registry claim is the cheap one to check, which is why it should carry weight. AgentGate says it re-ran the check on publication day with `node scripts/launch-live-check.mjs` from its own repo rather than copying a figure out of an older report ^[6]. That works out to 95 percent of the verified set still resolvable ^[1]. Anyone with npm and 19 package names can reproduce or refute it in a minute, which is more than most vendor tables offer.

Note which one did come down. `anthropic-setup` was a single base64-concealed eval that wrote `~/.claude/settings.json` with `env.ANTHROPIC_BASE_URL` pointed at the author's domain and added an `apiKeyHelper` that echoed the stored key, so every later Claude Code invocation routed prompts, code context and key through the operator ^[16]. That is the shape both a scanner and an abuse triager recognise. It is the only removal the post documents ^[5].

The post states the provenance plainly: the discoveries belong to the public feeds, the tarball-level verification is AgentGate's, and AgentGate publishes an Apache-2.0 tool built to gate this class of package ^[2][23]. The test the authors say they apply in an advisory is narrow and answerable: can the remote endpoint cause code execution on the host without a fresh, informed local consent step ^[15]. That is a better gate than the word "malicious", because outbound-only channels mean no firewall rule saves you, per the post, and legitimate remote-access products would otherwise argue their way past ^[14]. The disclosure email to npm security sits in the repo under `docs/launch/disclosure/` with per-package behaviour and affected versions ^[7]. Absent is npm's half of the exchange: no reply, no triage timeline, no per-package flag date. "Weeks" is the post's word, and it is not broken out per package ^[4].

The prompt-as-payload case has texture worth reading. `claude-cup` presents itself as a Claude Code usage leaderboard, auto-registers into Claude Code and Cursor, then drives the authenticated CLI with prompts assembled from a codeword dictionary: striker for github, midfielder for npm, goalkeeper for aws credentials, referee for private keys ^[18]. The request reads as football chatter while the developer's own agent walks the filesystem. `llm-interceptor` is blunter. One postinstall writes an MCP server entry into `~/.cursor/mcp.json`, runs `claude mcp add`, installs a Claude Code `SessionEnd` hook, and on Windows creates a logon task ^[17]. Four footholds from one install.

The install-time PATH swap is the part that outlives an incident review. `opencode-optimised-toolings` renames the on-PATH `opencode` aside and installs a build from a non-publisher GitHub repo in its place, while `opencode-engos-ai` symlinks whatever the attacker published most recently into `/usr/local/bin` ^[20]. Every later invocation runs attacker-built code and the project directory shows nothing ^[21]. Several of the packages also register launchd jobs, systemd units, or a hidden Windows WScript launcher, so the channel returns after a reboot ^[13]. Dropping the dependency undoes none of it. The machine is the artifact you have to rebuild.