npm scope
@doist
LPM Firewall blocks 3 packages in the @doist npm scope. 3 have LPM's own review and are listed first.
Sep 22, 2026
@doist/comms-cli@3.4.1
Install hook abuseThe automatic postinstall path concretely overwrites existing AI-agent skill files across multiple foreign tools. Under the lifecycle control-surface policy, this is blockable install-hoo...
Sep 14, 2026
@doist/todoist-cli@5.3.5
AI-agent control-surface riskThis is an unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the blocking policy. The additional install-time authenticated request increases the...
Sep 11, 2026
@doist/twist-cli@3.0.8
AI-agent control-surface riskThe postinstall lifecycle performs unconsented mutation of foreign and broad AI-agent control surfaces. This meets the install-hook abuse blocking boundary despite skipping paths where no...
Each card opens the package page with its evidence and every recorded version.