npm detections from LPM Firewall.

This is a concrete staged remote-code-execution chain hidden behind a transaction-data API. The absence of lifecycle hooks does not mitigate runtime execution after an ordinary library call.

The package has no install hook, but its runtime code automatically uploads selected CI environment secrets to a hardcoded remote endpoint. This is concrete credential exfiltration, not m...

The package's automatic postinstall modifies both ~/.claude.json and ~/.codex/config.toml to install a package-controlled MCP server. This meets the block policy for unconsented install-t...

The lifecycle hook performs concrete cross-agent persistence and automatic enablement, meeting the firewall block condition. The inspected network and dynamic-code primitives do not mitig...

The package has a concrete install-time mutation of a foreign global AI-agent command surface. Its lack of observed exfiltration reduces scope but does not remove the command-hijack risk.

The lifecycle behavior is concrete and active by default, not merely a user-invoked CLI feature. It downloads and executes remote scripts during installation, so the package warrants bloc...

The hard-coded remote service, embedded privileged defaults, account mutation, whole-project source scanning, and automatic persistent setup form a concrete unconsented attack chain.

The lifecycle behavior performs unconsented external account administration and project mutation, not merely local security-tool setup. The hardcoded credential path and Git-email transmi...

The install-time chain performs unconsented identity disclosure and privileged remote account mutation against a fixed endpoint. This exceeds package-aligned local linting or hook setup a...

The automatic lifecycle path performs unconsented identity disclosure and privileged remote account management against a hardcoded third-party server. This concrete behavior exceeds the c...

Source establishes an automatic fixed-endpoint telemetry path carrying license and host identifiers plus exception content. The benign native-addon install behavior does not remove this r...

The package executes an opaque downloaded native payload during postinstall and automatically requests AI-tool onboarding. This is a concrete unconsented install-time AI-agent control-sur...

The lifecycle hook performs concrete, unconsented destructive writes to Codex and Claude Code skill locations. This meets the install-time foreign/broad AI-agent control-surface mutation...

This meets the firewall block policy for an unconsented npm postinstall mutation of a foreign, global AI-agent control surface. The local-only copy and opt-out do not remove that install-...

The package contains a concrete, automatic data-exfiltration path for user and host identifiers during normal functionality. The absence of lifecycle hooks does not mitigate that runtime...

This is a concrete remote-code-execution loader, not a benign dynamic evaluation pattern. It is runtime-triggered rather than install-time, but warrants blocking because an untrusted remo...

Source directly establishes a default external credential receiver and an automatic recovery path that calls it. No lifecycle hook is needed for this credential-exfiltration behavior.

Source establishes a default-enabled credential submission to an unrelated hard-coded service during normal login recovery. No install hook is required for this concrete runtime credentia...

This is a concrete credential-capture payload deployed into an agent skill directory, not a package-aligned runtime feature. The non-executing native rebuild postinstall does not mitigate...

This is concrete, unconsented install-time remote binary execution with no independent authenticity verification. The lifecycle guard does not mitigate the risk for normal npm installs.

The automatic postinstall path mutates Windows Terminal profiles used to launch Claude and Codex and creates elevated persistence. These actions occur without an explicit user setup command.