npm detections from LPM Firewall.

The default routing of an OpenAI credential to a different fixed gateway is concrete credential exfiltration during normal use. The unchecked executable fallback adds supply-chain executi...

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The configuration persists across projects and installs commands triggered by future Claude Code sess...

This is an unconsented postinstall mutation of a broad AI-agent control surface. The automatic hooks and global instruction changes meet the install-hook abuse blocking policy.

Automatic global-install mutation of OpenCode's configuration adds a package plugin and broad shell permission. This meets the policy threshold for malicious install-hook abuse even witho...

The guarded global-install condition does not establish user consent for automatic OpenCode configuration and permission changes. The lifecycle hook creates a persistent, broadly permitte...

This is an automatic install-time mutation of foreign AI-agent control surfaces, including persistent instructions and command hooks. The global-only guard does not provide consent for th...

This is an automatic post-install write to a consumer Claude Code configuration with a wildcard command hook. That meets the policy's concrete install-hook abuse boundary.

The automatic lifecycle hook silently installs a broad Claude command hook into the consuming project. This meets the policy threshold for malicious install-hook abuse even without observ...

The package automatically persists a wildcard Claude Code command hook during installation, without an explicit setup command. This meets the install-control-surface blocking rule even th...

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The wildcard command is automatically activated for every Claude tool call, satisfying the instal...

This is an automatic postinstall mutation of a pre-existing global AI-agent command surface, rather than normal package-local bin linking. No source evidence shows network exfiltration, b...

The package has a concrete automatic install-time overwrite of a broad, potentially foreign AI-agent command surface. Its lack of network or credential behavior limits scope but does not...

The automatic lifecycle hook mutates the consumer's broad MCP agent configuration and registers an npx-delivered executable channel. This meets the install-time AI-agent control-surface a...

The automatic postinstall writes a foreign AI-agent configuration and configures it to run another package through npx. This is an unconsented install-time control-surface mutation and me...

The automatic postinstall path and subsequent self-repair create a concrete persistent AI-agent control-surface mutation. The global-only guard does not provide explicit user consent for...

The package has a postinstall-triggered path that mutates multiple external AI-agent configuration and plugin surfaces. This meets the policy definition of unconsented install-hook AI-age...

The automatic lifecycle hook creates persistent AI-agent instruction and hook surfaces in user homes. This meets the policy threshold for malicious install-hook abuse despite the absence...

The lifecycle-triggered global setup directly modifies multiple AI-agent home configurations and installs event-driven commands. This meets the install-hook abuse policy regardless of the...

The package has a concrete postinstall path that installs and persists package-controlled AI-agent instructions and command hooks in user home directories. This meets the policy for malic...

The package has a concrete automatic postinstall path that mutates broad, foreign AI-agent control surfaces and installs event-triggered commands. Its global-only guard does not establish...

The verified postinstall chain changes Claude and Codex user-level control surfaces without an explicit user setup action. That concrete install-hook behavior meets the publish-block poli...