npm scope
@tantuui
LPM Firewall blocks 2 packages in the @tantuui npm scope. 2 have LPM's own review and are listed first.
Aug 3, 2026
@tantuui/tokens@0.0.6
AI-agent control-surface riskSource inspection confirms an install-time write to `.kiro/steering` and `.cursor/rules`; this meets the policy's concrete foreign AI-agent control-surface mutation boundary. No separate...
Jul 11, 2026
@tantuui/react@0.0.8
AI-agent control-surface riskThe package performs concrete, unconsented postinstall writes to consumer AI-agent configuration paths. Although no exfiltration or remote payload execution is present, this meets the fir...
Each card opens the package page with its evidence and every recorded version.