npm detections from LPM Firewall.

Source inspection confirms an automatic postinstall chain that mutates third-party AI client configuration and host security settings. This meets the policy threshold for malicious instal...

The package performs concealed, unconsented external account mutation on every authenticated connection and combines it with vendor fingerprinting and remote feature revocation. The lifec...

The source implements silent, automatic remote collection of browser logs and confirms that normal mail composition logs sensitive metadata. The benign workspace-linking postinstall hook...

This package contains a concrete, automatic runtime exfiltration path to a third-party host. The benign package-local postinstall symlinks do not mitigate that behavior.

The package contains a direct runtime path that serializes sensitive IMAP configuration and sends it to an unrelated remote logging endpoint. This is concrete credential exfiltration, des...

This package performs an unconsented postinstall mutation of a broad foreign AI-agent control surface. That behavior meets the install-control-surface blocking policy despite the absence...

The CLI combines ordinary first-run credential collection with a hard-coded external gateway and persistent credential storage. This is concrete credential-routing behavior, not a noisy s...

The package performs unconsented postinstall mutation of foreign, user-level AI-agent control surfaces. This is concrete install-hook abuse even though no external exfiltration endpoint w...

The automatic postinstall mutates the user's global Claude Code configuration and installs a command that applies to every session. This is an unconsented broad AI-agent control-surface c...

The package performs unconsented postinstall mutation of multiple global AI-agent control surfaces. This meets the install-control-surface block policy even though no credential theft or...

Direct source inspection confirms an automatic postinstall hook that writes a broad OpenCode agent control surface into the consuming project. This meets the install-hook abuse blocking p...

The source confirms unconsented postinstall mutation of broad, foreign AI-agent configuration and hooks on global install. This meets the install-control-surface block policy despite no o...

This is concrete credential exfiltration to a package-selected third-party endpoint during normal runtime login. The absence of install hooks does not remove the risk to consumers who aut...

The package has a concrete credential-exfiltration path: a standard OpenAI key is forwarded to a fixed non-OpenAI default endpoint. Its automatic unchecked native-binary download increase...

This is unconsented postinstall mutation of a consumer AI-agent control surface, including enabled executable MCP definitions. The absence of direct exfiltration does not remove the concr...

The package contains a complete, obscured remote-download-and-execute chain activated by its primary API. The absence of an install hook does not mitigate this concrete runtime remote-cod...

The package automatically exfiltrates command logs and identifying data during normal CLI use, with additional exam surveillance. This is concrete data collection behavior, not merely a u...

Automatic postinstall injection into both global Codex and Claude skill directories is a concrete broad AI-agent control-surface mutation. The recursive pruning increases the persistence...

This package establishes an unconsented lifecycle-to-build chain that can overwrite generic AI-agent instructions from a remote server and self-update through npm. The behavior is a concr...

This package implements concrete remote collection of agent prompts and tool activity while modifying several AI-agent configuration surfaces. The behavior is explicit-command triggered r...

This package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execut...