npm detections from LPM Firewall.

The package performs forced, silent postinstall writes to multiple foreign AI-agent configuration locations. This meets the blocking policy for unconsented lifecycle mutation of a broad A...

Source directly shows silent transmission of sensitive account configuration to an unrelated remote logging endpoint during normal runtime. The benign workspace-only postinstall hook does...

This is a concrete credential-exfiltration path to an unrelated logging endpoint during normal application initialization. No install hook is required for the harm to occur.

Source inspection confirms an all-sites extension that captures login credentials and sends them to a hard-coded remote endpoint. The confirmation prompt does not remove the material mism...

The package performs unconsented postinstall mutation of a consumer repository and installs persistent workflow code that reports repository metadata externally. This is concrete unwanted...

This is concrete unconsented postinstall mutation of the user's Claude Code control surface, including high-permission agent content and MCP registration. That meets the package firewall...

The install-time hook makes an unconsented persistent change to a consumer repository and installs a workflow that reports repository metadata externally. This is concrete malicious lifec...

The package contains a concealed, remote-controlled runtime action that automatically follows arbitrary WhatsApp newsletters from the user's authenticated account. This is concrete unauth...

This is concrete install-time persistence in a foreign project, not a user-invoked setup command. The workflow also causes recurring external reporting after installation.

Source inspection confirms an unconsented postinstall mutation of global Claude Code settings and executable command registration. This meets the blocking policy for a foreign, broad AI-a...

The package crosses the block boundary because postinstall automatically starts a process that can modify foreign Claude workspace controls. The local destination and safety checks reduce...

The package performs unconsented postinstall mutation of global Claude Code files and injects an MCP server that automatically installs another package. This meets the blocking policy for...

The package contains a concrete arbitrary-command execution path fed by a remote AI response, plus intrusive lifecycle behavior. This exceeds normal Git-client functionality and creates a...

This is concrete import-time malware, not a user-invoked library feature. It downloads remote code, executes it hidden, and establishes persistence.

The package contains an automatic install-time remote payload loader that executes unaudited code from a hard-coded endpoint. This is concrete malware behavior, regardless of the benign-l...

The manifest contains a concrete, unconsented postinstall remote-code execution chain unrelated to the stated TOTP functionality. This is malicious install-time behavior.

The package contains an automatic install-time remote code execution chain that is unrelated to its advertised authentication utility. This is concrete malicious behavior and warrants blo...

Normal Android startup silently transmits sensitive account configuration and broad client logs to an external endpoint. This is concrete unconsented data-exfiltration behavior.

This is concrete, unconsented runtime tampering with a foreign installed package that causes a messaging-account action. It is unrelated to the advertised libsignal functionality and is m...

The source contains a concrete credential-exfiltration path from Android account initialization to a hard-coded external logging endpoint. The benign workspace-only postinstall hook does...

This package uses an unconsented postinstall hook to create broad AI-agent control files outside its own directory. That is a concrete foreign control-surface mutation and meets the block...