npm detections from LPM Firewall.

The launcher implements undisclosed collection and exfiltration of CLI and environment-derived data, including error stacks, to fixed logging endpoints. Although there is no install hook,...

The install lifecycle performs broad project-level Claude control-surface mutation rather than limiting itself to package-owned files or an explicit setup command. No lifecycle exfiltrati...

This is concrete unconsented install-time data exfiltration combined with remote opaque executable staging. Hash validation limits transit tampering but does not make the automatic collec...

The source establishes a complete path from a local secret file to a package-controlled network endpoint, triggered by remote control activity. The harmless postinstall message does not m...

The automatic lifecycle hook downloads and executes opaque native code specifically to install AI-agent hooks. This meets the install-control-surface blocking policy.

The package has a concrete automatic postinstall path that mutates global AI-agent configuration and activates companion extensions. This meets the install-hook abuse boundary even though...

Direct source inspection confirms an automatic postinstall chain that delegates permission changes and Chrome MCP registration to a third-party bridge. This is an unconsented install-time...

The postinstall hook makes unconsented, broad changes to foreign AI-agent control surfaces and the host. This meets the install-hook abuse blocking policy despite its global-install guard...

The package combines reviewer and assistant-directed social engineering with an explicit command that persistently changes consumer lifecycle scripts and transmits dependency inventory. I...

Direct inspection confirms an automatic install hook establishing hidden, elevated at-logon persistence and a daemon restart loop. No external exfiltration was found in the reviewed persi...

This is an unconsented install-time mutation of broad consumer AI-agent control surfaces, reinforced by lifecycle-setting changes and reviewer-suppression payloads. The absence of observe...

The import-time payload combines deliberate obfuscation, host access, concealed process creation, and network transmission. Its behavior is incompatible with the advertised package surface.

The package contains a concrete credential-disclosure path that is selected by default through its exported API. The lack of an install hook and safer CLI default do not remove this libra...

The package directly exfiltrates a wallet private key during ordinary SDK operations. This is credential theft, regardless of the stated gas-sponsorship purpose.

This is concrete postinstall modification of a foreign AI-agent installation, including credential-check and authentication weakening, followed by destructive dependency pruning. The beha...

The package uses an automatic npm lifecycle hook to modify global configuration for multiple unrelated AI-agent products and to register executable MCP integrations. This meets the instal...

The automatic lifecycle hook delivers opaque native code from remote hosts and the audited JavaScript subsequently executes it. Same-origin checksum verification cannot protect against a...

This package automatically stages remotely controlled native binaries during installation and executes them later. Same-origin checksum metadata does not provide independent integrity pro...

This package has a concrete automatic postinstall chain that mutates global AI-agent configuration and skills plus the consumer project. That meets the install-hook abuse block boundary e...

This is a concrete automatic postinstall mutation of foreign and broad AI-agent control surfaces. The opt-out does not establish affirmative consent for the lifecycle action.

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The lifecycle guard only prevents a separate global install and does not prevent the skill writes.