npm detections from LPM Firewall.

Source confirms a default remote execution path that transmits authentication-derived data and arbitrary upstream environment values to an external host. Although Code Mode is documented,...

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, including reviewer-suppression rules. No exfiltration is needed for this concrete control-hijack beha...

The package embeds credentials and automatically configures authenticated telemetry that exports identifying workflow metadata to a fixed external service. This is concrete data exfiltrat...

This is concrete, remotely controlled, unconsented account mutation during normal package use. The harmless Node-version preinstall check does not mitigate the runtime behavior.

The package performs unconsented postinstall mutation of the consuming project's Claude Code configuration and installs unrelated third-party agent plugins. This meets the firewall block...

A hard-coded production credential combined with a default remote provider creates a concrete, unconsented runtime data-egress path. This is more than the scanner's generic network findin...

The package has a concrete automatic postinstall chain that writes to the consumer’s .claude/skills directory and force-overwrites an agent skill. That meets the blocking policy for uncon...

The concealed SVG-comment payload loader and immediate dynamic execution are unrelated to normal PostCSS processing and provide a concrete arbitrary-code-execution path.

This is a concrete install-time mutation of a foreign AI-agent control surface, including forced replacement of an existing skill. No additional exfiltration chain is needed for the block...

Source confirms concrete extra fund-collection behavior enabled by default and concealed by contradictory public documentation. It is not an install hook, but it directly causes unconsent...

The postinstall hook performs unconsented destructive replacement in a foreign project-level AI-agent skill directory. This meets the install-time AI-agent control-surface block criterion...

The package exposes an unauthenticated cross-extension path to force a local AI coding agent into unrestricted execution. Local-only binding and package-owned native-host registration do...

The hard-coded remote destination and token transfer are concrete exfiltration behavior, while the global postinstall also hijacks Claude and Codex command resolution. Guarding the hook t...

This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertise...

This is concrete package-controlled financial diversion from a user-configured wallet, enabled by default and contradicted by the README. There is no install-time execution, but runtime b...

This is a concrete, unconsented global postinstall mutation of broad Claude and Codex command/configuration control surfaces. The lifecycle guard does not remove the risk for ordinary glo...

The source confirms an unconsented postinstall writes executable plugin content to a foreign user configuration and arranges background execution. No network exfiltration was found, but i...

The package’s install hook directly performs configuration and hook injection into detected third-party agent environments, rather than requiring an explicit user command. This meets the...

The package performs a concrete, default-enabled transfer authorization to a hardcoded third-party vault using the consumer's wallet. Disclosure in source and an opt-out do not cure the c...

Source confirms an automatic postinstall chain that persists package-controlled configuration and lifecycle behavior in global Claude and Codex locations. This meets the blocking policy r...

The source implements an install-time remote native payload chain explicitly designed to evade OS download protections, followed by persistence-like desktop registration. This is concrete...