npm detections from LPM Firewall.

The lifecycle script performs the concrete broad agent-control-surface mutation that the firewall policy reserves for blocking. Although the configuration is branded Wowok and no direct c...

The package has no install-time hook, but its normal cloud-join path executes unvalidated remote commands and a downloaded shell script, then uploads captured interactive terminal data. T...

The source establishes a direct collection-to-network path for local identity, device fingerprint, and Figma identifiers without an in-source consent control. This is concrete data exfilt...

Direct source inspection confirms unguarded postinstall writes to both foreign agent configurations. This meets the blocking policy regardless of the local stdio transport.

The source confirms concrete install-time native payload delivery and explicit evasion of SmartScreen/Gatekeeper protections. The checksum does not mitigate the package author's deliberat...

The package has no install hook, but its delivered SVG directly executes an unrelated remote script and installs a request-intercepting proxy service worker at browser runtime. This is co...

The source confirms the lifecycle mutation rather than merely indicating it statically. This meets the firewall block boundary for unconsented postinstall writes to foreign/broad AI-agent...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, which meets the firewall block policy. No separate credential-exfiltration endpoint was confirmed.

This is concrete, install-time mutation of foreign and broad AI-agent control surfaces. The absence of network exfiltration does not mitigate that policy-triggering behavior.

The package contains a concrete server-directed remote-code execution path and substantial browser-context collection. Its lifecycle hook is not install-time, but that does not mitigate t...

Runtime source establishes a hardcoded external receiver plus automatic authorization and refresh-token forwarding. The lack of install hooks does not mitigate this browser-time credentia...

The concrete install-time behavior is unconsented mutation of broad foreign AI-agent control surfaces, including auto-approval policy changes. This meets the blocking boundary even though...

The confirmed lifecycle path performs unconsented install-time mutation of foreign/broad AI-agent control surfaces. The lack of observed exfiltration does not remove that concrete install...

The manifest establishes an unconsented install-time second-stage package installation. No local source mitigates or explains this behavior.

The package’s install hook intentionally delivers and registers an unsigned native payload while circumventing platform download protections. Hash validation does not mitigate the publish...

The only package behavior is an automatic postinstall mutation of the consuming project to add another package. That concrete, unconsented dependency injection warrants blocking.

The package's only observable behavior is an unconsented postinstall mutation of the consumer project to inject another dependency. This is a concrete supply-chain attack behavior despite...

Source confirms the lifecycle hook and automatic cross-agent skill mutation; this meets the install-control-surface block boundary. Scanner similarity labels were not relied upon.

The source establishes a concrete postinstall chain that persists package-controlled instructions and lifecycle execution in global agent configuration. This meets the block policy for un...

Concrete install-time mutation of both Claude Code and Codex global MCP configuration meets the block policy for unconsented foreign/broad AI-agent control-surface writes.