npm detections from LPM Firewall.

The package performs unconsented postinstall mutation of foreign AI-agent configuration and changes the default Codex child-agent route. The global-install guard narrows the trigger but d...

This is unconsented install-time collection and remote transmission of host-identifying information. The duplicate lifecycle callbacks and suppressed failures make it concrete malicious i...

The global-only guard limits scope, but it does not make the automatic writes to ~/.codex/config.toml and a default agent user-invoked. This is a concrete postinstall AI-agent control-sur...

This package performs unconsented, automatic install-time transmission of host-identifying data to an unrelated endpoint. The behavior is concrete exfiltration and warrants blocking.

The package performs unconsented install-time collection and transmission of local host metadata to an unrelated external endpoint. The benign runtime placeholder does not justify or miti...

Direct source inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project identifiers to an unrelated endpoint. The benign placeholder entrypoint does not...

Direct inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project metadata to an external endpoint. The runtime entrypoint is inert, so the harmful behavi...

The automatic postinstall hook makes broad, persistent changes to multiple global AI-agent control surfaces and the consumer project. This meets the install-hook abuse policy even though...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, including recursive deletion within its installed skill directories. The bridge’s deliberate permi...

This release automatically writes and prunes user-level skills for two unrelated AI-agent platforms during postinstall, rather than requiring an explicit setup command. The added runtime...

This is an unconsented install-time mutation of global and project AI-agent control surfaces, including permissions of existing agents. The absence of exfiltration does not offset the con...

Source inspection confirms an automatic postinstall chain that mutates third-party AI client configuration and host security settings. This meets the policy threshold for malicious instal...

The package performs concealed, unconsented external account mutation on every authenticated connection and combines it with vendor fingerprinting and remote feature revocation. The lifec...

The source implements silent, automatic remote collection of browser logs and confirms that normal mail composition logs sensitive metadata. The benign workspace-linking postinstall hook...

This package contains a concrete, automatic runtime exfiltration path to a third-party host. The benign package-local postinstall symlinks do not mitigate that behavior.

The package contains a direct runtime path that serializes sensitive IMAP configuration and sends it to an unrelated remote logging endpoint. This is concrete credential exfiltration, des...

This package performs an unconsented postinstall mutation of a broad foreign AI-agent control surface. That behavior meets the install-control-surface blocking policy despite the absence...

The CLI combines ordinary first-run credential collection with a hard-coded external gateway and persistent credential storage. This is concrete credential-routing behavior, not a noisy s...

The package performs unconsented postinstall mutation of foreign, user-level AI-agent control surfaces. This is concrete install-hook abuse even though no external exfiltration endpoint w...

The automatic postinstall mutates the user's global Claude Code configuration and installs a command that applies to every session. This is an unconsented broad AI-agent control-surface c...

The package performs unconsented postinstall mutation of multiple global AI-agent control surfaces. This meets the install-control-surface block policy even though no credential theft or...