npm detections from LPM Firewall.

The source establishes a concrete credential-harvesting and remote-authentication chain, not merely support for user-provided environment keys. Although execution is CLI-invoked and there...

Source inspection confirms a credential-harvesting extension with broad site access and a hard-coded external default endpoint. The user confirmation does not remove the concrete remote c...

Direct inspection confirms a concealed staged-payload loader with eval and detached process execution in the ESM runtime path. Absence of lifecycle hooks does not mitigate this applicatio...

The package contains a concrete, obfuscated import-time remote payload execution chain. Lack of npm lifecycle hooks does not mitigate the ESM import path.

The source confirms automatic lifecycle execution and external DNS transmission of host-derived data. The inert runtime export does not mitigate the install-time behavior.

The package contains an automatic install hook with concrete secret disclosure and filesystem persistence. The absence of network code does not remove the install-time credential-harvesti...

The ESM runtime entry contains a concrete concealed payload-execution chain, not merely suspicious primitives. Lack of lifecycle hooks does not mitigate import-time arbitrary execution.

The appended Babel-config payload is unrelated to asset extraction and contains an explicit remote code-execution chain. Absence of install hooks reduces automatic-install exposure but do...

The obfuscated tooling payload has a concrete remote-code-execution chain and detached-process launch, unrelated to the declared package function. Absence of an install hook limits automa...

This is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.

Source directly confirms an install-time dependency-confusion payload that exfiltrates host metadata to an attacker-controlled endpoint. Its stated research purpose does not remove the co...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces with persistent lifecycle execution. The absence of install-time exfiltration does not mitiga...

This is concrete unconsented install-time mutation of a foreign project manifest, concealed in a detached delayed child process. No exfiltration was found, but the dependency-injection be...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces through an unverified remote payload. The source directly establishes the installation and execution chain.

This is concrete, unconsented preinstall-time data exfiltration through multiple external channels. The package has no legitimate runtime function beyond the beacon.

The package’s install hook performs unprompted remote-code installation and alters the broad, foreign Codex agent surface. This meets the blocking policy despite vendor-aligned endpoints....

Although there is no install lifecycle hook, explicit CLI setup creates a concrete remote-code-execution and persistence chain and mutates a foreign AI-agent configuration surface. The so...

This is not a normal icon/SVG package: it deploys a persistent browser proxy and forwards session cookies through its transport. The absence of npm lifecycle hooks limits install-time imp...

Source confirms unconsented runtime account mutation and remote fingerprint attestation, activated by normal package use. This is concrete malicious behavior, not a scanner-only indication.

This is an unconsented postinstall chain that executes an opaque downloaded binary to alter Codex and Claude Code hook surfaces. It meets the blocking boundary for foreign AI-agent contro...