npm detections from LPM Firewall.

This is an unconsented postinstall mutation of a foreign, global AI-agent control surface. The automatic global command registration warrants blocking even without confirmed exfiltration.

The concealed remote redirect chain is concrete harmful behavior, even though it is not triggered during npm installation. The package should be blocked as a browser-delivered malicious p...

The package performs unconsented system package installation during postinstall and normal startup, then automatically globally reinstalls itself from npm. These are concrete install-hook...

This is an unconsented install-time remote code execution chain. The signature check does not mitigate the package author's ability to deliver arbitrary code after publication.

This is a concrete install-hook payload delivery chain: an opaque native executable is automatically downloaded from a fixed host with TLS verification disabled, extracted, and enabled fo...

The package performs unconsented remote script execution and external tool configuration from a postinstall hook. This is concrete install-hook abuse, even though the snapshot contains no...

The lifecycle hook automatically modifies a separately installed global Codex host package and causes it to import package-controlled code later. That concrete foreign control-surface mut...

The package has an automatic postinstall path that writes package-controlled content into multiple foreign global AI-agent configuration surfaces. This meets the install-hook abuse policy...

Source implements a privileged vendor-service takeover, forged authentication state, and bypass of local tool approval, with optional authenticated traffic capture. The absence of install...

The package contains a concrete editor-control hijack and paid-tier bypass, not merely a user-configured proxy. Although it has no install hook, the explicit runtime path performs privile...

The source establishes both default telemetry of arbitrary user queries and a direct instruction to an AI agent. These are concrete harmful behaviors despite the absence of an install hook.

The postinstall hook performs unconsented, broad mutation of foreign AI-agent control surfaces. No exfiltration was found, but the automatic cross-platform persistence meets the install-h...

The package automatically mutates consumer AI-agent configuration and instructions at install time. This is concrete install-hook abuse even though the inspected code does not directly ex...

The source establishes an automatic path from a normal sync to harvesting AI-agent session transcripts and adding them to cloud-sync input. This is concrete data exfiltration behavior, no...

The package uses an automatic postinstall path to persist instruction and command-hook behavior across detected AI-agent homes. The global-only guard does not provide user-command consent...

The package has a concrete automatic lifecycle chain that broadly mutates unrelated AI-agent skill locations and replaces existing content. This meets the install-hook abuse blocking policy.

This is an unconsented postinstall mutation of a foreign project’s broad AI-agent control surfaces and Git lifecycle. That concrete automatic persistence behavior meets the publish-block...

Source code establishes credential exfiltration to an unrelated AI endpoint and execution of AI-supplied shell commands. These are concrete malicious behaviors, not necessary Git client f...

The inspected source establishes an automatic postinstall chain that writes and merges global AI-agent configuration. This is concrete install-hook abuse under the stated policy.

The package has no install hook, but its normal runtime creates a remote command channel that can select arbitrary local directories and return file contents to the endpoint. That is conc...

This is concrete default-on collection and third-party transmission of local environment metadata during normal CLI use. The absence of an install hook limits the trigger but does not rem...