npm detections from LPM Firewall.

The automatic lifecycle hook performs unconsented mutation of foreign global Claude/Codex agent control surfaces and registers executable lifecycle behavior. This meets the install-time A...

This is concrete, unconsented install-time mutation of a shared/foreign AI-agent credential and configuration surface, coupled with automatic account provisioning and provider redirection...

The package contains a concrete remote-code-execution chain activated by normal runtime use. Lack of an npm lifecycle hook limits installation impact but does not mitigate the malicious r...

Source directly implements a remote download-and-execute chain through Bash. Although it is not install-time, it is an exported package capability with a concrete malicious payload endpoint.

The postinstall performs concrete destructive mutation of credentials/settings associated with Anthropic/Claude and automatically replaces credentials through a vendor network request. Th...

The benign engine check does not explain the obfuscated runtime mutation. Concealed third-party branding injected into user messages is concrete, non-consensual payload manipulation.

The package performs unconsented postinstall mutation of a foreign/broad Claude-compatible AI-agent control surface, including deleting credentials and replacing them with its own provide...

Source establishes credential exfiltration to a hard-coded non-Facebook endpoint, including an automatic recovery trigger. No lifecycle hook is needed for this concrete runtime attack.

Source inspection confirms unsolicited import-time networking and a public helper that exfiltrates caller-supplied phone numbers to an unrelated host. The install hook itself is benign, b...

The package performs concrete, unconsented postinstall writes to an existing AI-agent prompt/control surface. This meets the firewall block criterion regardless of the absence of observed...

Source inspection confirms a runtime credential-exfiltration path to a hard-coded third-party endpoint during ordinary login. No install hook is needed for this concrete malicious behavior.

The package performs an automatic, unpinned remote-code execution chain during npm postinstall and uses it to register AI-agent hooks. This meets the firewall block boundary for unconsent...

The shipped source establishes an automatic remote-payload execution chain and unconsented Claude Code hook registration. No source-level integrity check constrains the executed script or...

Source confirms a concrete install-time credential/config replacement chain, not merely suspicious primitives. This meets the blocking policy for unconsented postinstall mutation of a for...

Source confirms an npm postinstall path that modifies Windows Terminal profiles for Claude/Codex and establishes a persistent scheduled task. This meets the install-time AI-agent control-...

The install-time, unprompted mutation of Windows Terminal profiles used to control Claude/Codex, combined with elevated persistence, is a concrete malicious chain. The locally configured...

The package performs concrete, automatic Windows persistence and foreign Terminal profile mutation from npm postinstall. This exceeds a normal CLI install hook and meets the install-time...

The unconsented postinstall modifies a foreign AI-assistant launch surface and installs persistent elevated execution. This is a concrete install-time control-surface and persistence chai...

This is a concrete, unconsented postinstall mutation of foreign AI-agent control surfaces with persistent hooks and relay behavior. The existing-directory guard does not make the installa...

This is unconsented install-time mutation of a foreign AI-agent control surface, meeting the block policy even though the hook is guarded and package-branded. The source also establishes...

This is concrete, stealth-oriented install-time credential and data exfiltration with no legitimate functional purpose. Block publication.