npm scope
@keruyun
LPM Firewall blocks 2 packages in the @keruyun npm scope. 2 have LPM's own review and are listed first.
Oct 20, 2026
@keruyun/agent-cli@1.15.1
MalwareThe postinstall hook automatically discloses identifying machine and user data to a fixed endpoint without affirmative installer consent. This verified install-time disclosure supports bl...
Aug 17, 2026
@keruyun/cli@1.5.2
Data exfiltrationSource confirms default telemetry of rich runtime context and unprompted global updates on every CLI invocation. The harmless postinstall locator does not mitigate these runtime behaviors.
Each card opens the package page with its evidence and every recorded version.