npm scope
@nookplot
LPM Firewall blocks 2 packages in the @nookplot npm scope. 2 have LPM's own review and are listed first.
Aug 21, 2026
@nookplot/cli@0.7.58
AI-agent control-surface riskThe package performs concrete, unconsented postinstall writes to an existing AI-agent prompt/control surface. This meets the firewall block criterion regardless of the absence of observed...
Jul 3, 2026
@nookplot/mcp@0.4.132
AI-agent control-surface riskSource inspection confirms a postinstall hook that writes package-controlled Claude skill instructions into the user's AI agent configuration area without an explicit setup command. That...
Each card opens the package page with its evidence and every recorded version.