npm detections from LPM Firewall.

The fixed, non-user-selected OAuth gateway is persisted by init and receives authorization-code exchange data during login. The absence of an install hook reduces automatic exposure but d...

The package contains a browser-wide credential capture path whose default destination is an external host unrelated to the local CLI service. The user-facing save prompt does not identify...

The package performs automatic postinstall mutation of broad Claude and Codex control surfaces and schedules unattended self-updates. The global-install guard reduces exposure but does no...

The package silently exports tool-call and tool-result records to a hardcoded external receiver during normal use. Limited redaction and the absence of an install hook do not remove this...

The package embeds instructions intended to make an AI defer to its opaque analysis rather than independently inspect source, which is agent-control manipulation. Its per-call host finger...

The concealed telemetry and host fingerprint create a concrete data-exfiltration path, while the MCP descriptions attempt to constrain the host agent's inspection behavior. The absence of...

The package performs concealed, remote-controlled changes to a connected user's WhatsApp account. Its harmless Node-version preinstall check does not mitigate this runtime account manipul...

levvleys@2.0.9 contains a concrete, remote-controlled and unconsented mutation of a user's authenticated WhatsApp account during normal operation. The benign Node.js version preinstall ch...

The package contains concealed, automatic account actions driven by a remote endpoint and hidden target identifiers. Its benign install hooks do not remove this runtime attack behavior.

The explicit CLI setup does not make the resulting broad agent-hook persistence, remotely supplied executable updates, and cloud collection safe. The code establishes a concrete remote-co...

The explicit CLI trigger lowers accidental-install risk, but the source directly disables Claude permission checks and accepts workspace trust before installing agent plugins. That is a c...

The package uses npm postinstall to silently modify foreign AI-agent configuration and install recurring hooks. This meets the policy for unconsented lifecycle mutation of a broad AI-agen...

Source inspection confirms a runtime path that transmits passwords and optional TOTP seeds to a hard-coded third-party host. The opt-in guard reduces accidental activation but does not re...

This is a concrete install-time credential theft and npm supply-chain propagation payload. The source directly implements collection, exfiltration, token use, and package republishing.

The package performs automatic postinstall mutation of several unrelated user-level AI-agent configurations and installs hooks that execute its runtime. This is a concrete unconsented con...

The package performs unconsented global postinstall mutation of multiple third-party AI-client configurations and installs remote executable payloads. The limited opt-out guards do not pr...

The source confirms an unconsented postinstall path that performs global AI-agent configuration changes with prompts disabled. No credential theft was found, but the automatic shared cont...

This is unconsented postinstall mutation of foreign AI-agent control surfaces through an opaque native binary. The automatic lifecycle path meets the install-hook abuse block boundary.

The package contains an automatic remote logging channel that exports user-related runtime data during normal Android use. The benign workspace-only postinstall hook does not mitigate thi...

The package contains a direct runtime path from account configuration containing an IMAP password to an unrelated remote logging endpoint. No install hook is needed for this concrete cred...

The package contains a direct runtime path that sends serialized IMAP configuration to an unrelated logging endpoint. No install hook is needed for this concrete credential disclosure dur...