npm scope
@wwkit
LPM Firewall blocks 2 packages in the @wwkit npm scope. 2 have LPM's own review and are listed first.
Sep 27, 2026
@wwkit/harness@1.0.31
AI-agent control-surface riskThe package executes a persistent OpenCode configuration change automatically at install time, rather than through an explicit user command. This is concrete AI-agent control-surface hija...
Sep 17, 2026
@wwkit/sshproxy@1.0.14
Install hook abuseThe postinstall hook does not only write a config file; it starts a tunnel path that can plant an SSH key on a remote host and a local unauthenticated control server. That is concrete ins...
Each card opens the package page with its evidence and every recorded version.