npm scope
@firestitch
LPM Firewall blocks 2 packages in the @firestitch npm scope. 2 have LPM's own review and are listed first.
Sep 13, 2026
@firestitch/component-tools@18.0.18
Install hook abuseThis is a concrete install-hook abuse chain affecting the consumer's files and Git remote. The editor settings are benign-looking, but they do not justify destructive deletion, commit, an...
Jul 29, 2026
@firestitch/standards@1.0.2
AI-agent control-surface riskThe lifecycle hook performs concrete, persistent AI-agent instruction-file mutation outside the package directory. Absence of exfiltration does not remove this install-time control-surfac...
Each card opens the package page with its evidence and every recorded version.