npm detections from LPM Firewall.

The source establishes an automatic postinstall chain that removes user-wide Codex registrations and persists further install-time execution in consumer projects. This meets the install-h...

The automatic lifecycle hook executes mutable remote code and performs hook registration without a separate user setup action. This meets the install-time AI-agent control-surface abuse b...

This is a concrete unconsented postinstall mutation of multiple foreign and broad AI-agent control surfaces, plus consumer-project mutation. The lifecycle behavior meets the publish-block...

The source implements a concealed, remote-controlled action that changes a connected user's WhatsApp account state automatically. Its lifecycle hooks are benign, but the runtime subscript...

This package performs unconsented sensitive-file collection and disclosure during an automatic install hook. The absence of a real network request limits the observed scope but does not m...

The package performs concrete credential collection and transmission automatically after pairing, without a separate user confirmation. Its benign postinstall message does not mitigate th...

The package contains concrete credential exfiltration to an unrelated fixed host and automatic consumer-project dependency installation enabled by default. These behaviors are reachable t...

The package uses an automatic postinstall to alter consumer-project and AI-agent configuration, then deliberately persists those changes after installation. This is concrete install-hook...

This release has a concrete, unconsented postinstall path that mutates a broad OpenCode AI-agent control surface and causes the package to be loaded. The package-aligned Google endpoints...

OpenSSF Malicious Packages via OSV confirms kisama-js@0.4.8 as malicious (MAL-2026-15645): Malicious code in kisama-js (npm)

OpenSSF Malicious Packages via OSV confirms kisama-js@0.4.6 as malicious (MAL-2026-15645): Malicious code in kisama-js (npm)

OpenSSF Malicious Packages via OSV confirms lil-swisgom-hlepers@49.9.9 as malicious (MAL-2026-15689): Malicious code in lil-swisgom-hlepers (npm)

This is a typosquatting package with an automatic lifecycle hook that writes and replaces executables in a foreign AI CLI home directory. The identity mismatch and unconsented control-sur...

The install-time hook executes remote code and changes global tooling and AI-skill state by default. This creates a concrete, unconsented supply-chain execution path.

The package embeds an unrelated third-party subscription and account-email workflow in its server bundle. This is concrete data collection and external communication unrelated to the decl...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, not merely a user-invoked setup tool. The CI and command-availability guards limit execution in some envi...

The package performs broad AI-agent and project mutations automatically from postinstall, including user-wide Codex changes and detached follow-up execution. This is a concrete unconsente...

This is an unconsented postinstall mutation of a foreign AI-agent control surface that deliberately removes a safety reminder. The local API client does not offset the install-time attack...

The package performs automatic postinstall mutation of a foreign consumer project and AI-agent configuration, then persists execution in that project's lifecycle scripts. This is a concre...

The package uses an automatic lifecycle hook to silently disable a safety instruction in a separately installed AI-agent SDK. The confirmed local CLI endpoint does not offset this concret...

The package performs unconsented postinstall mutation of a consumer project's AI-agent control surface and persists its own lifecycle command. That meets the install-control-surface block...