npm detections from LPM Firewall.

This is concrete, unconsented postinstall mutation of project AI-agent control surfaces, including automatic installation of third-party plugins. The lack of observed credential theft doe...

The package intentionally routes wallet recovery phrases to an external endpoint through a benign-looking UI control. This is concrete secret exfiltration despite the absence of install-t...

Concrete postinstall-triggered writes alter broad, foreign AI-agent configuration and shell startup surfaces. The absence of a hardcoded receiver does not mitigate the unconsented control...

The install hook performs a destructive, automatic replacement of the global `codex` launcher rather than relying on the package manager's normal bin linking. This meets the install-time...

The explicit confirmation and lack of an npm install hook reduce stealth, but the bundled all-sites credential collector defaults to an unrelated external endpoint and constitutes a concr...

The package performs unconsented postinstall persistence in global Claude Code settings, configuring broad lifecycle hooks that execute other binaries. This meets the install-time AI-agen...

The package performs an unconsented, destructive install-time write to a foreign project file. Other detected dynamic and network-related features are runtime framework functionality and...

The package’s automatic postinstall mutates foreign AI-agent control surfaces and host configuration. This meets the blocking policy for unconsented install-time broad AI-agent control-su...

The concrete, unconsented global postinstall overwrite of the codex AI-agent command is sufficient for blocking. No network exfiltration is needed for this control-surface hijack.

This is a concrete, exported remote denial-of-service capability, not merely a noisy static signal. Its runtime invocation requirement does not negate the package’s explicit attack functi...

Source inspection confirmed deliberate reviewer/agent manipulation and propagation into generated artifacts. This warrants blocking despite otherwise package-aligned build behavior.

The package deliberately performs an unconsented, silent import-time installation of a differently named registry package in the consumer project. This is a concrete supply-chain executio...

Direct source inspection confirms automatic writes into ~/.claude/skills and ~/.codex/skills, not merely a user-invoked setup command. This meets the install-time foreign AI-agent control...

This is a concrete staged remote-code-execution chain, not merely a networking or evaluation primitive. Lack of an install hook limits the trigger but does not remove the malicious runtim...

The hard-coded third-party authentication endpoint receives raw user credentials at runtime, which is not required for a local Facebook API client. No install hook is needed for this conc...

The package performs destructive mutations and fingerprint telemetry during postinstall. The global-install gate does not make deletion of potentially unrelated binaries or device trackin...

Source confirms unconsented install-time remote payload execution and external AI CLI installation. The explicit opt-outs and isolated default config do not mitigate code execution before...

The automatic lifecycle hook creates a concrete unconsented remote-code-execution chain. Its apparent runtime-bootstrap purpose does not mitigate executing mutable network content during...

Direct source inspection confirms an install-time destructive credential mutation and automatic vendor-account provisioning, followed by runtime preference for the injected credential. Th...

The package embeds a default external logging route that transmits normal runtime records, including raw scan input, without an explicit caller-provided endpoint. This is concrete data ex...

The package contains a concrete remote code execution chain hidden behind its public API. The lack of lifecycle hooks limits automatic installation execution but does not mitigate the mal...