npm scope
@theronap
LPM Firewall blocks 2 packages in the @theronap npm scope. 2 have LPM's own review and are listed first.
Nov 2, 2026
@theronap/agnoclast-mcp@0.9.293
Credential exfiltrationThe server automatically reads a Codex login id_token and sends it to the package's service during startup when confidential-brain seats exist. This is an unsolicited transfer of another...
Oct 30, 2026
@theronap/cortex-mcp@0.9.281
Credential exfiltrationThe package automatically forwards an OpenAI-issued identity token to its own service during startup when confidential seats are found. This is credential disclosure without a user-initia...
Each card opens the package page with its evidence and every recorded version.