npm detections from LPM Firewall.

The package contains a concrete install-time chain that mutates both project-level agent state and user-wide Codex plugin state. That exceeds a package-local setup action and meets the bl...

The package's npm postinstall mutates broad, foreign AI-agent control surfaces and configures later hook execution. This meets the install-control-surface block criterion despite the abse...

The package performs install-time delivery and registration of an unsigned native payload while explicitly evading platform security checks. The bundled checksum does not address the inte...

This package contains a concrete, enabled-by-default outbound logging path to hard-coded external receivers that includes user-supplied scan data. The absence of install hooks does not re...

The package performs unverified remote code execution during postinstall to install a separate Hermes AI agent. This is a concrete unconsented lifecycle mutation of a foreign AI-agent con...

Direct source inspection confirms unconsented postinstall mutation of both Claude and Codex global skill directories, including replacement of existing targets. The installed instructions...

The package has concrete postinstall code that writes its bundled instructions into several unrelated AI-agent skill directories. Safety-oriented skill content does not remove the unconse...

This is a concrete credential-exfiltration and remote-code-execution chain activated by ordinary package use. Lack of an install hook does not mitigate the import-time attack.

This package performs a concrete, unconsented global-install mutation of foreign AI-agent skill paths and overwrites existing directories. The global-only guard does not remove the instal...

Source inspection confirms a concrete import-time global install and remote configuration chain unrelated to the advertised testing library. This is malicious dependency behavior.

The package persistently deploys and injects instructions designed to defeat agent safety boundaries, then supplies command execution capability. No install hook or external exfiltration...

Direct source inspection confirms a postinstall-triggered executable installs Codex and Claude Code hooks. This meets the blocking policy for unconsented lifecycle mutation of foreign/bro...

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the block boundary. The user-configured Payload REST client does not mitigate the...

The install-time mutation of a user-wide foreign AI-agent configuration and registration of executable hooks is a concrete policy-blocking chain. No exfiltration was found, but it is not...

Source establishes a complete persistence-and-exfiltration chain: the scaffold installs an agent directive, seeds its destination, and supplies the POST client. The lack of lifecycle exec...

The automatic installation and persistence of a differently named package is concrete unconsented remote-code delivery behavior, not a package-aligned API operation. Absence of lifecycle...

The package performs a concealed import-time installation of a differently named package into the consuming project, controlled by a remote registry response. No lifecycle hook is needed...

The package’s postinstall performs an unconsented global AI-agent skills installation, meeting the install-control-surface blocking boundary. No additional exfiltration is required for th...

Direct inspection confirms concrete install-time remote shell access, not merely a suspicious primitive. This is malicious behavior with no user action required beyond installing the pack...

The source confirms a concrete postinstall chain that mutates global Codex trust and hook settings based solely on pre-existing state. This meets the install-control-surface block boundar...

Source establishes an automatic postinstall path that invokes an opaque native hook installer, and the package documents that it installs hooks for two external agent products. This meets...