npm detections from LPM Firewall.

Direct source inspection confirms an install-time remote-code-execution chain. The remote payload is dynamically evaluated and is not constrained to a package-aligned static asset.

The postinstall performs concrete global Claude/Codex control-surface mutation, including destructive replacement of existing agents and lifecycle-hook registration. This meets the instal...

This is an unconsented postinstall mutation of broad AI-agent control surfaces, including permissive Claude settings, hooks, and remote MCP configuration. The lifecycle behavior meets the...

Source establishes a concrete runtime data-exfiltration path for personal mailbox metadata to an unrelated endpoint. The absence of lifecycle hooks does not mitigate this runtime behavior.

The source establishes an unconsented postinstall chain that mutates foreign AI-agent configs and installs recurring commands. This meets the firewall block boundary despite global-instal...

This is concrete unconsented data exfiltration through a hidden default remote transport, with an explicit environment-value harvesting path. The lack of install hooks does not mitigate t...

The concealed default remote sink and automatic upload of user application logs form a concrete, undisclosed exfiltration path. Lack of install hooks does not mitigate this runtime behavior.

The concealed default remote logging target and raw environment-value logging create a concrete unconsented data-exfiltration path. The absence of install hooks does not mitigate runtime...

The concealed default remote destination and automatic transmission of user log data form a concrete data-exfiltration path. No lifecycle hook is needed because the behavior activates dur...

The package's import-time side effect is unrelated to its advertised assertion API and silently installs and executes another package with remote configuration. This is a concrete malicio...

This is concrete, unconsented import-time execution that globally installs and runs an unrelated package with an external endpoint. Absence of an npm lifecycle hook does not mitigate the...

Direct source inspection confirms automatic collection and Telegram upload of the importing process's working directory. This is a concrete credential/data-exfiltration chain, not a benig...

The package performs an undisclosed, automatic action on the user's authenticated WhatsApp account, concealed in an obfuscated policy module. Its install hook is not the attack vector, bu...

This is not a lifecycle-only concern: executable runtime code injects broad file-harvesting instructions into a permission-bypassing AI agent. The lack of install hooks does not mitigate...

The import-time executable is concrete, unrelated to the package purpose, and contains explicit malware capabilities. No install hook is needed for impact because ordinary application imp...

Despite its stated research purpose, the package automatically exfiltrates identifying build-environment data during installation through two network channels. This is concrete unconsente...

This is concrete, unconsented install-time host-data exfiltration disguised as a placeholder package. It warrants blocking.

The package has no apparent functionality beyond an unconsented install-time hostname beacon to an unrelated hard-coded endpoint. This is concrete data exfiltration behavior.

This is a concrete unconsented install-time network beacon that exports host identity to an unrelated hard-coded endpoint. It has no stated package functionality beyond the placeholder RE...

The automatic postinstall mutates a foreign Claude-related AI-agent surface and deletes files from ~/.claude; this meets the block boundary. The unchecked executable download adds further...