npm detections from LPM Firewall.

This is unconsented install-time mutation of an AI-agent credential/control surface, including targeted deletion of competitor-associated credentials and automatic replacement with a vend...

Source confirms a default third-party credential receiver and reachable runtime paths that transmit supplied Facebook secrets. Absence of lifecycle hooks does not mitigate this credential...

The package contains a concrete runtime path that serializes potentially password-bearing IMAP settings and sends them to an unrelated remote log endpoint. Lack of lifecycle hooks does no...

Source directly implements concealed capture, AI-assisted submission, proctor evasion, and respawning persistence under a misleading diagnostic description. The install hook itself is ine...

The package performs concrete unconsented postinstall remote payload download and execution, not merely user-invoked setup. This warrants blocking regardless of whether the named endpoint...

The package performs unconsented postinstall remote payload execution, not merely first-party configuration. This is a concrete install-time RCE supply-chain risk.

The install hook mutates the user-wide Grok binary and config without an explicit command, while the package's README points users to a different official scope. This is a concrete foreig...

The lifecycle hook makes persistent, unprompted changes to user shell profiles and shadows the Claude command. This meets the firewall block policy despite no observed exfiltration.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain was needed for this verdict.

Source inspection confirms a deceptive executable proxy-site payload in an SVG package, with automatic remote analytics and proxy cookie handling on document rendering. No install hook ex...

Source inspection confirms a package script retrieves and executes an unauditable remote payload. The normal MCP server code does not justify that behavior.

Source directly implements host-project mutation, plaintext transmission of caller identity data, and a fixed-recipient payout flow. The payout behavior is inconsistent with the public co...

The package contains concrete, stealthy postinstall mutation of the consuming project’s dependency manifest. No network exfiltration is needed for this install-hook supply-chain abuse to...

This is a concrete remote-code-execution chain, activated during normal dotenv configuration and concealed by an obfuscated endpoint. It is not install-time, but it is malicious runtime b...

Source shows silent network logging to a non-service endpoint and direct inclusion of sensitive account configuration. This is concrete runtime exfiltration, not a static similarity signal.

The package contains a concrete, automatic credential-bearing telemetry path to a non-mail-service endpoint. No install hook is needed for this runtime data-exfiltration behavior to be ma...

This contains concrete, unconsented runtime account mutation and host-fingerprint exfiltration, not merely package-aligned WhatsApp functionality. The install hook is local-only but does...

The package has a concrete, manifest-reachable postinstall chain that silently registers hooks in Claude Code settings. Package-aligned telemetry does not remove the unconsented foreign A...

The package has a concrete postinstall persistence chain affecting global Claude Code settings and shell profiles. Although the inspected statusline contains no observed exfiltration, the...

The postinstall chain performs unconsented remote identity/account administration against a fixed external host using embedded default credentials, not merely local development-tool setup...

The import-time payload combines host-data collection and outbound Axios submission with concealed detached process execution. The absence of lifecycle hooks limits the trigger to runtime...