npm detections from LPM Firewall.

The automatic lifecycle hook modifies a consumer-owned MCP configuration rather than only package-owned files. That creates an unconsented agent-extension execution path.

This is concrete install-time remote-access and persistence behavior affecting local and remote SSH control surfaces. Existing credentials gate success but do not provide meaningful conse...

The package has a concrete automatic postinstall chain that overwrites skill content in Claude, agent, and Codex directories. Opt-out support does not establish consent for the default mu...

This is an unconsented postinstall mutation of broad AI-agent control surfaces in the consumer project. The automatic configuration includes remote MCP endpoints and a command launcher.

The package performs unconsented postinstall mutation of foreign AI-agent instruction files. This meets the install-control-surface blocking policy even though no exfiltration was found.

The package performs unconsented postinstall mutation of broad consumer AI-agent control files. This meets the install-control-surface blocking policy despite no observed exfiltration.

The package embeds automatic, hardcoded third-party telemetry in a UI component and exports embedding-site metadata when the component is used. This is concrete runtime data exfiltration...

The package embeds concealed remote license enforcement that can destroy a consumer application's visible DOM at runtime. This is concrete destructive behavior, despite the absence of ins...

The automatic self-update and unattended reconfiguration create a persistent agent-control path, and the injected instruction explicitly suppresses permission requests for external action...

This is a concealed, remotely controlled kill switch in a browser component, protected by deliberate obfuscation. It has no install-time hook or secret harvesting, but the concrete remote...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The lifecycle hook directly persists package-authored instructions into Claude Code and Codex loca...

This is a concrete destructive install-hook abuse: the package automatically rewrites broad consumer-project files and persists control through an injected build plugin. The reviewer-dire...

This is an automatic postinstall mutation of foreign AI-agent control surfaces combined with execution of another CLI installer. Under the isolation policy, that concrete chain requires b...

This is unconsented install-time system and host information exfiltration. The automatic lifecycle hook makes the behavior a concrete malicious install-hook abuse.

This is concrete, unconsented install-time command execution and host-information exfiltration to an unrelated webhook. The import-time beacon expands the trigger beyond installation.

The package implements a complete automatic lifecycle chain that patches a foreign Codex host executable and causes its own detached code to run later. This meets the install-control-surf...

The fixed, unofficial trace destination and credential-bearing POST create a concrete data-exfiltration path inconsistent with a general agent library. Lack of an install hook limits the...

The automatic lifecycle hook makes unverified remote binary placement and privileged system mutation without a separate user command. This concrete install-time behavior, host telemetry,...

The fixed private collector and disguised OpenAI tracing configuration create a concrete, undisclosed data-exfiltration path. The lack of lifecycle execution limits the trigger but does n...

The package contains a concrete remote-code-execution path hidden behind an unrelated worktime command. Although it is not install-triggered, directly executing an opaque remote payload i...

The automatic postinstall hook mutates broad, user-level Claude Code and Codex instruction surfaces. This meets the install-hook policy for unconsented foreign AI-agent control-surface mu...