npm detections from LPM Firewall.

The entrypoint includes an import-time, delayed protestware chain that deliberately disables page interaction and loads external media for targeted users. This is concrete malicious behav...

Source inspection confirms an automatic foreign agent configuration write and instructions for unapproved outbound actions. The harmless-looking telemetry hook does not mitigate that conc...

Source inspection confirms concrete, unconsented postinstall writes to global Claude Code and Codex MCP configuration. This meets the block policy for foreign and broad AI-agent control-s...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces. It meets the firewall block policy even though the inspected hook does not itself exfiltrate data.

This is an unconsented postinstall mutation of foreign AI-agent control surfaces. Documentation does not remove the install-time control-surface risk.

The lifecycle hook performs unconsented remote code execution through a downloaded installer. This concrete install-time execution chain warrants blocking.

The source establishes a concrete, default credential-exfiltration path to a fixed third-party host during normal login and automatic recovery. The lack of install hooks does not mitigate...

Source inspection confirms local-data transmission to hard-coded third-party Telegram destinations plus broad automatic postinstall mutation. Although the network actions require named CL...

The lifecycle hook performs forced upgrades of registered external projects, including agent instruction and skill locations, rather than limiting setup to the package directory. This mee...

Source inspection confirms an unconsented postinstall writes to Herdr's plugin and configuration paths, then installs a detached clipboard-handling process. This meets the block policy fo...

The source implements a concrete unconsented global postinstall chain that changes third-party AI-client control surfaces and installs remote native code. Product-aligned endpoints do not...

The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise o...

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.

This is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.

This is a concrete install-time remote-code-execution chain, not a package feature. The mismatched README further supports deceptive intent.

The package performs an unconsented global-install postinstall mutation of Claude’s skill directory and replaces conflicting symlinks. Its explicit CLI network and upload behavior does no...

The package's global postinstall mutates several foreign AI-agent skill directories automatically. That concrete lifecycle behavior meets the firewall block boundary even though its searc...

The package performs unconsented postinstall mutation of broad, foreign AI-agent skill directories. This meets the firewall block rule even though no credential theft was found.

The automatic postinstall mutation of broad, foreign AI-agent skill directories is a concrete unconsented control-surface change. No credential theft was found, but the lifecycle behavior...

The package contains an automatic secret-migration path that sends environment-derived secrets to a hard-coded external endpoint. No install hook is present, but the runtime credential ex...

The lifecycle hook automatically modifies broad foreign AI-agent skill roots, satisfying the package firewall rule for an unconsented postinstall control-surface mutation. No credential e...