npm scope
@indigoai-us
LPM Firewall blocks 2 packages in the @indigoai-us npm scope. 2 have LPM's own review and are listed first.
Oct 17, 2026
@indigoai-us/hq-cli@5.345.145
Install hook abuseThe reachable postinstall path installs a persistent user service without requiring the consumer to invoke the daemon-install command. This is concrete install-hook persistence, so the pa...
Sep 11, 2026
@indigoai-us/hq-cloud@6.16.36
Data exfiltrationThe package automatically harvests raw agent session logs and routes them into cloud sync, while its telemetry bypasses personal opt-out for company-attributed activity. The guarded globa...
Each card opens the package page with its evidence and every recorded version.