npm detections from LPM Firewall.

The install-time remote archive is not pinned independently, and its content is used to populate global Claude Code skills with remotely controlled names. This is an unconsented broad AI-...

The package contains a concrete, enabled default path that exports runtime records and error data to hard-coded third-party webhooks. It has no install-time execution, but the application...

The concrete install-time deletion of existing AI credentials and automatic replacement with a vendor key establishes an AI-agent control-surface hijack. Vendor-aligned networking does no...

The package performs unconsented postinstall mutation of multiple AI-agent configurations and workspace trust state. This meets the firewall block boundary regardless of the scanner simil...

Source establishes a direct path from account credentials to a third-party logging endpoint during ordinary initialization. This is concrete credential exfiltration, not required mail-sto...

The source contains a direct chain from stored account password to an unrelated remote logging endpoint during normal Android initialization. Absence of lifecycle hooks does not mitigate...

The package performs unconsented global postinstall mutation of third-party AI-agent integrations, meeting the blocking control-surface policy. Additional host security changes and unchec...

Source inspection confirms an install-time command that automatically changes Claude Code's user-level skill directory. This meets the blocking policy for unconsented postinstall mutation...

The package performs confirmed postinstall writes to multiple global AI-agent configuration locations. This meets the blocking policy regardless of the absence of confirmed credential exf...

This package contains a concrete credential-exfiltration path: serialized IMAP account configuration is sent to an unrelated remote logging endpoint during normal initialization. Absence...

The package performs unconsented install-time remote shell execution and privileged host mutation. This is a concrete malicious install chain, not merely a user-invoked setup capability.

Source inspection confirms hard-coded external receivers and automatic runtime logging of rich records. This is concrete data exfiltration, despite the absence of an install-time hook.

Source inspection confirms runtime collection and exfiltration of local activity and AI-tool inventory, plus an obfuscated arbitrary shell execution path. The absence of install hooks doe...

Direct source inspection confirms intentional deletion of a foreign root-level script and unsafe broad control-surface changes. These are concrete harmful behaviors despite requiring a CL...

The package performs a concrete, default extra-money collection from configured wallets to a hard-coded package recipient. The configurable opt-out and runtime notice do not remove the un...

The package contains an unconsented import-time self-updater that invokes npm with consumer-project privileges and changes consumer files. This is a concrete remote update and execution c...

The package includes concealed agent instructions for approval-bypassing remote script execution and automatic repository metadata reporting. The lack of an npm lifecycle hook does not re...

This is concrete unconsented install-time persistence in a consumer repository, coupled with external reporting on future repository activity. The browser bundle's ordinary API traffic do...

The package contains a direct, unconsented remote logging path that can transmit full IMAP configuration including optional passwords. The benign workspace postinstall hook and local MCP...

The package performs automatic postinstall replacement of skills across unrelated agent homes, including Codex and Claude. That is a concrete AI-agent control-surface hijack even though n...

The package performs unconsented postinstall writes to broad user-global Claude skill paths using remotely supplied content and names. This is a concrete AI-agent control-surface mutation...