npm detections from LPM Firewall.

The package embeds a concealed, cryptographically gated decrypt-and-spawn chain in its primary Mutex implementation. This is concrete malicious runtime behavior, not an unused static prim...

The package performs concealed import-time remote payload execution unrelated to its declared text-helper functionality. This is concrete malware behavior.

This is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.

The source directly constructs a set of environment-secret values and uploads it automatically to a fixed external host. This is credential exfiltration, irrespective of the absence of in...

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious pr...

This is concrete credential exfiltration to a fixed third-party endpoint, not required for normal Facebook session emulation. The copied example additionally opts into installing a foreig...

This is concrete credential and telemetry exfiltration to a fixed unofficial plaintext endpoint, despite requiring user-invoked setup. No lifecycle hook is needed for the harmful chain on...

Source inspection confirms the policy-defined blocking behavior: unconsented postinstall mutation of global Claude Code and Codex MCP configuration. The explicit CLI-only hook installer d...

The package performs concrete, unconsented postinstall mutation of the consuming project's dependency manifest through a detached delayed process. No exfiltration was found, but the insta...

The package has a concrete postinstall chain that mutates foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface...

Source establishes automatic upload of real environment-derived secrets to a fixed external receiver during normal CLI execution in GitHub Actions. This is concrete credential exfiltratio...

This is concrete install-time malware, not a package-aligned diagnostic feature: it establishes remote command execution, persistence, and internal credential/service reconnaissance.

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface w...

Source directly implements covert profile collection and account sweeping, coupled to permission-bypassing AI-agent command execution and platform synchronization. Absence of npm lifecycl...

Direct inspection confirms concrete install-time persistence, remote shell capability, host reconnaissance, and internal credential/service probing. This is malicious behavior unrelated t...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, meeting the blocking policy. The declared vision feature does not remove the lifecycle-control r...

Source directly confirms a postinstall write into ~/.claude/skills and an agent-directed shell-execution payload. This meets the policy boundary for an unconsented lifecycle mutation of a...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Lack of exfiltration does not remove the install-time agent-control hijack behavior.

Direct source inspection confirms a hardcoded, enabled-by-default external telemetry upload of rich local AI/work-project data. The absence of an npm install hook does not remove the conc...

The package embeds deliberate, unconsented terminal takeover in postinstall, including a detached follow-up process. Although no exfiltration was found, this concrete install-time behavio...