npm detections from LPM Firewall.

The package has a concrete automatic lifecycle path that overwrites and prunes a consumer-wide AI-agent control directory. Local-only execution does not remove the control-hijack risk.

This package performs unconsented, destructive postinstall mutation of a consumer project and persists control through an injected build plugin. That behavior is not necessary for a libra...

The automatic lifecycle hook modifies a foreign global CodexHost launcher and renderer, then arranges later execution of package-controlled code. Explicit setup download behavior does not...

Direct source inspection confirms a normal-runtime, default-configured outbound logging path to active external webhooks. The absence of install hooks does not mitigate this concrete appl...

The package automatically executes unpinned remote shell code and alters a separate home-directory AI-related tool during postinstall. This is a concrete unconsented install-hook abuse pa...

The package performs unconsented postinstall environment collection, internal metadata probing, persistence, and third-party reporting. Its self-description does not neutralize these conc...

The package contains an automatic install-time data-collection and external-egress path, not merely an inert test fixture. Its self-described testing purpose does not provide consumer con...

This is unconsented install-time command execution and host-data exfiltration to a third-party endpoint. The import-time trigger reinforces the malicious lifecycle behavior.

An automatic preinstall hook launches a deliberately obscured payload with concrete credential and outbound automation capabilities. This is malicious install-hook abuse.

This is a concrete malicious install-time chain: an automatic lifecycle hook executes an opaque payload with credential, network, filesystem, and process capabilities unrelated to the sta...

The automatic preinstall hook executes a deliberately concealed, capability-rich payload. This is concrete install-hook abuse, not package-aligned setup.

The automatic preinstall execution of concealed credential- and network-capable code is concrete malicious install-hook behavior. Readable CLI functionality and the package-aligned spec c...

The package contains an automatic postinstall path that mutates a foreign, user-wide AI-agent configuration and installs agent skills. This is concrete unconsented install-hook abuse unde...

The source establishes an automatic postinstall chain that broadly modifies user AI-agent configuration and installs a separate executable MCP dependency. This meets the firewall policy f...

The automatic lifecycle hook makes destructive and account-provisioning changes to a user-level AI-agent control surface. This is unconsented install-hook abuse, despite the vendor-aligne...

The automatic postinstall hook mutates numerous third-party AI-agent skill locations, including an unconditional universal fallback. This meets the blocking policy for unconsented broad A...

This is an unconsented postinstall mutation of a consumer AI-agent control surface. The automatic MCP registration and persistent agent-instruction writes meet the blocking policy.

The hidden, hard-coded secondary upload of local attachment contents is concrete data exfiltration. Explicit user selection of an issue attachment does not consent to an undisclosed trans...

This is concrete, unconsented install-time data exfiltration to external endpoints. Reviewer-directed claims that the behavior is benign do not change the executable behavior.

The package has a concrete automatic postinstall chain that writes broad consumer AI-agent configuration and adds a blocking Claude hook. This meets the install-control-surface block poli...

The automatic lifecycle hook forcibly installs package-authored skills into both project and global Codex/Claude control directories. This meets the install-hook abuse blocking policy des...