npm detections from LPM Firewall.

The automatic postinstall hook mutates broad, foreign AI-agent configuration surfaces and the user's Python environment. This meets the install-control-surface blocking policy regardless...

The automatic postinstall remote-code execution is a concrete supply-chain attack surface, not a user-invoked feature. Its mutable unverified payload warrants blocking publication.

The automatic postinstall lifecycle mutates the consumer's Claude Code configuration and registers package code for every tool action. This meets the policy threshold for malicious AI-age...

The automatic global-install hook writes package-controlled skill content into several foreign AI-agent skill locations. That is unconsented broad control-surface mutation, even though th...

The confirmed automatic postinstall chain mutates Claude and Codex MCP configuration, a foreign AI-agent control surface, and adds Windows login persistence. This meets the install-hook a...

The source establishes an automatic postinstall chain that executes remote shell content and mutates the Codex plugin control surface. The global-install guard narrows exposure but does n...

The automatic postinstall performs broad consumer-project mutation and writes AI-agent instructions, then installs a plugin that restores overwritten source files. This meets the install-...

Source inspection confirms automatic install-time persistence, elevated execution, hidden daemon restart, and silent system-package installation. These are concrete install-hook abuse beh...

The automatic, obfuscated postinstall chain launches a remote global AI-agent skill installer and targets foreign agent-control locations. This meets the install-hook abuse blocking bound...

The package performs a concrete destructive credential action automatically at install time. The native binary is opaque, and no installation need justifies clearing an existing user's au...

The automatic postinstall hook mutates foreign project AI-agent configuration and instruction files. This meets the install-time AI-agent control-surface abuse blocking policy despite no...

The package implements credential-pool routing and a remotely controlled destructive account wipe, alongside automatic shell persistence. Although there is no npm install hook, these conc...

This is unconsented postinstall mutation of a foreign AI-agent control surface, including third-party plugin installation. The automatic detached reconciliation makes the mutation persist...

The automatic postinstall performs broad destructive mutation of ~/.claude and registers browser-agent integration. This is an unconsented install-time mutation of a foreign AI-agent cont...

This package contains concrete, unconsented mutations of a user's WhatsApp subscriptions and message content, plus a reachable shell-injection flaw. These behaviors are unrelated to ordin...

The confirmed install-time mutation of consumer files and existing AI-agent configuration is a concrete unconsented control-surface change. No exfiltration was needed to establish the ins...

This is concrete unconsented postinstall mutation of broad OpenCode and consumer-project control surfaces, reinforced by runtime self-update behavior. The package-aligned endpoints and pa...

The executable forwards both GitHub Actions identity and environment-derived secrets to a fixed remote service. The absence of an install hook reduces reachability but does not remove the...

This is unconsented install-time mutation of a consumer project and its future lifecycle behavior, with detached reconciliation to continue the chain. The CI guard and reduced mode do not...

This is deliberate, concealed, user-unconsented account manipulation on the normal runtime path. The harmless version-check install hook does not mitigate the runtime behavior.

The package has a concrete automatic postinstall path that broadly modifies consumer OpenCode assets and configuration, including registration of another plugin. No exfiltration was found...