npm detections from LPM Firewall.

This is concrete, unconsented install-time collection and exfiltration of consumer host and project data. Comments calling it a proof of concept do not neutralize the implemented behavior.

This package has a concrete automatic install-time collection-and-exfiltration path. The empty runtime API does not justify or mitigate that behavior.

The package performs broad AI-agent configuration and project mutations automatically during dependency installation, then uses a detached retry mechanism to preserve them. This is concre...

This is concrete, unconsented install-time data exfiltration to an external endpoint. The package's harmless-research assertions do not change the observed behavior.

This package performs automatic postinstall repair of broad Claude lifecycle hooks rather than limiting agent configuration to an explicit user command. That matches install-hook abuse ev...

OpenSSF Malicious Packages via OSV confirms @yancyyu/agentcli@1.9.12 as malicious (MAL-2026-11123): Malicious code in @yancyyu/agentcli (npm)

OpenSSF Malicious Packages via OSV confirms @yancyyu/agentcli@1.9.10 as malicious (MAL-2026-11123): Malicious code in @yancyyu/agentcli (npm)

The package contains a concrete runtime data-collection and upload path for request and response content. No lifecycle hook is present, but the automatic telemetry is sufficient for a mal...

This is an unconsented install-time mutation of a consumer project's persistent execution and AI-agent control surfaces. The detached reapplication makes the mutation survive the package...

The automatic lifecycle hook performs broad consumer-project and user-wide AI-agent configuration mutations. This meets the blocking policy for unconsented postinstall mutation of foreign...

The automatic lifecycle hook rewrites consumer AI configuration and routes AI calls through code that transmits prompt and response data. This is a concrete unconsented AI-agent control h...

The automatic lifecycle hook performs privileged system package installation and destructive dependency rebuild actions, then preserves a runtime path that repeats them. These actions exc...

The package automatically sends telemetry containing identity and command activity to a fixed unrelated endpoint at runtime. No install hook is needed for this concrete data-exfiltration...

The package has a concrete automatic install-time chain that broadly mutates foreign AI-agent control surfaces. This meets the install-hook abuse blocking boundary even though no credenti...

The package combines broad AI-agent control-surface writes with prompt/reply exfiltration and remotely delivered executable hook updates. Although setup is CLI-triggered and not an npm li...

The package has no install hook, but its normal runtime behavior automatically exports agent transcripts and enables cloud-delivered commands. The direct curl-to-sh updater adds a concret...

The package performs broad, automatic AI-agent and project mutation during postinstall, rather than requiring an explicit user command. Its detached reconciliation mechanism makes those c...

The package performs unconsented, automatic installation tracking to an unrelated vendor-branded endpoint. This is concrete install-time data exfiltration rather than normal user-invoked...

The automatic postinstall hook broadly rewrites a consumer project and installs a plugin that restores package-owned files, so it exceeds transparent package setup. No install-time creden...

The automatic global postinstall hook mutates a broad AI-agent process control surface by signalling processes selected with a generic marker. Its guardrails reduce exposure but do not es...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The lack of network access in the installer does not remove the persistence and control-surface risk.