npm detections from LPM Firewall.

Source establishes concealed remote control and unconsented account actions during ordinary runtime initialization. Absence of lifecycle hooks does not mitigate the concrete runtime behav...

The package’s postinstall creates or updates a Claude Code skill outside its own installation directory and explicitly states it activates in future conversations. The guard and opt-out d...

This is concrete, unconsented preinstall-time host and project metadata exfiltration to a fixed third-party callback. A stated research purpose does not remove the install-time disclosure.

The source implements automatic preinstall-time collection and external transmission of identifying host and project data. Its stated research intent does not remove the concrete unconsen...

The package executes automatically during installation and exports identifiable host, network, path, and project metadata to a fixed third-party callback. Its stated research purpose does...

Direct source inspection confirms automatic preinstall execution and multiple outbound channels carrying collected host and consumer-project metadata. The declared dependency-confusion Po...

The package implements a concrete credential-exfiltration chain to a hard-coded third-party endpoint, including an automatic configured-credential path. Absence of install hooks does not...

Source inspection confirms a postinstall hook that overwrites a pre-existing global Codex launcher, rather than relying on package-manager-owned bin linking. That creates a concrete broad...

The package performs unconsented install-time mutation of a broad AI-agent command control surface, including deletion of any existing launcher. No exfiltration is needed for this concret...

Source inspection confirms an automatic postinstall chain that installs a foreign global AI-agent CLI and mutates persistent execution surfaces. This meets the install-time foreign AI-age...

Source establishes a concrete default runtime action that alters a user's WhatsApp subscription. Lifecycle scripts themselves are benign, but do not mitigate the unsolicited follow behavior.

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the blocking lifecycle-control-surface policy even though no exfiltration end...

Source inspection confirms install-time mutation of user shell configuration and automatic persistence, not merely static hints. This is concrete unconsented behavior with system-wide sta...

The postinstall hook performs unconsented mutation of foreign and broad AI-agent control surfaces, including ~/.codex and ~/.claude. Disclosure in the README does not change that install-...

The global-install guard limits scope but does not make these postinstall changes user-consented. The package automatically modifies external AI-agent configuration and routing surfaces.

Source inspection confirms a concrete postinstall chain that automatically configures multiple foreign AI-agent environments on global install. This meets the supplied blocking boundary d...

The package’s postinstall hook performs remote third-party AI-skill installation through a shell command. This satisfies the policy’s concrete unconsented install-time foreign AI-agent co...

The package contains concrete, automatic modification of user-generated outbound media for undisclosed author attribution. This is not justified by its WhatsApp client functionality and i...

Source confirms concrete npm postinstall mutation of the consuming project’s multi-vendor AI-agent configuration surface. This meets the blocking policy regardless of the absence of confi...

Source confirms concrete install-time global installation of a foreign AI-agent CLI plus persistent user-environment mutation. This meets the block boundary even though no credential exfi...

This is concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the block boundary. No remote exfiltration is needed for this verdict.