npm detections from LPM Firewall.

The package performs unconsented postinstall mutation of foreign and broad AI-agent control surfaces, including a fallback that creates one. This meets the firewall block policy despite n...

The package concretely performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and weakens tool-approval settings. This meets the firewall block boundary reg...

Source inspection confirms an automatic postinstall mutation of global Claude Code and Codex MCP configuration. This is a concrete unconsented foreign/broad AI-agent control-surface write.

The embedded active webhook configuration and automatic runtime POST path establish concrete unconsented data exfiltration. The lack of an install hook does not mitigate this runtime beha...

The unguarded postinstall write to multiple foreign global AI-agent skill locations meets the firewall block criterion. The remote executable download increases impact but is not needed f...

The package contains hardcoded externally controlled webhook destinations that are enabled by default for runtime features and transmit serialized application records. This is concrete da...

This is a concrete, default-enabled runtime data-exfiltration path to hard-coded external recipients, not merely configurable application telemetry. The absence of install hooks does not...

Source confirms an automated credential upload path, not merely network or environment-variable use. Lack of npm lifecycle hooks does not mitigate the generated CI workflow's secret exfil...

The digest check limits transport tampering but does not mitigate the package's explicit purpose of bypassing OS trust warnings for an unsigned remote binary. This is concrete malicious i...

The postinstall hook performs broad foreign agent-control mutations with no user command or consent, including automatic approval and tool-interception hooks. This meets the blocking poli...

The package performs a concrete, unconsented postinstall mutation of consumer project AI-agent control files. Non-overwrite guards and benign-looking template content reduce impact but do...

Source inspection confirms the lifecycle hook automatically creates root-level AI-agent instruction files in consumer projects. The no-overwrite guard reduces scope but does not remove th...

The hook performs concrete, automatic mutation of broad third-party AI-agent configuration during npm installation. This meets the firewall block boundary regardless of the absence of obs...

The lifecycle hook concretely mutates multiple foreign, broad AI-agent control surfaces at install time. This satisfies the blocking policy even though no separate exfiltration endpoint w...

The package embeds covert, proactive collection instructions into its active agent system prompt and targets highly sensitive user data without an in-code consent gate. This exceeds a ben...

This package contains a concrete, runtime-reachable data-exfiltration chain: ordinary authenticated agent launches silently start a detached process that exports and uploads conversation...

This is concrete default-enabled data exfiltration to a hardcoded external endpoint, not merely local worklog functionality. The absence of an npm install hook does not remove the runtime...

The install hook performs concrete, unconsented mutation of a foreign project manifest and injects numerous dependencies in a detached process. No exfiltration was found, but this is suff...

The source establishes an unconsented postinstall chain that mutates global Claude and Codex control surfaces and registers a future lifecycle program. This meets the blocking policy rega...

Direct source inspection confirms an install-time exfiltration chain with command execution, credential-adjacent file reads, and a fixed external HTTP receiver. This is malicious behavior...