npm detections from LPM Firewall.

This is a concrete stealth anti-proctor and assessment-capture tool, not a benign diagnostic utility. The harmful runtime chain is user-triggered rather than install-time, but is sufficie...

The package contains no usable library code; its only executable artifact is an obfuscated, server-directed redirector hidden behind a Cloudflare-style challenge. No install hook is neede...

Source confirms default telemetry of rich runtime context and unprompted global updates on every CLI invocation. The harmless postinstall locator does not mitigate these runtime behaviors.

The package performs unconsented postinstall installation of a third-party AI-agent CLI and persistent user-environment changes. This meets the install-time foreign AI-agent control-surfa...

This is concrete concealed browser redirection behavior, not a package-aligned web component. No npm lifecycle hook is required because the declared main artifact is the malicious HTML page.

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. The absence of exfiltration does not remove that install-time control-surface risk. Product guar...

The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, compounded by mutable remote instruction retrieval. It meets the blocking policy even thoug...

The package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execut...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and incorporates remote instruction content. This meets the blocking policy despite no co...

This is a concrete unconsented postinstall mutation of a shared upstream AI-agent control surface, meeting the blocking policy. No source evidence of network exfiltration was found, but i...

The concrete postinstall behavior mutates broad foreign AI-agent configurations and introduces a remotely resolved MCP execution path. This meets the block boundary regardless of the abse...

The package’s postinstall deploys and force-overwrites behavior-bearing skills across unrelated agent runtimes without an explicit user command. This meets the install-control-surface blo...

This is concrete install-time mutation of a foreign, broad AI-agent control surface. The binary-presence guard limits reach but does not make the automatic configuration consensual.

The lifecycle behavior is source-confirmed and automatically mutates the consuming project's Claude/Codex configuration, including third-party agent plugins. This meets the block boundary...

This is concrete, unconsented install-time persistence. The absence of observed install-time exfiltration does not remove the risk of automatic background execution.

The source establishes concrete, automatic, forceful mutation of foreign AI-agent skill directories during npm installation. Under the install-control-surface policy, this requires blocki...

The postinstall is explicitly gated to global installation, but that lifecycle event automatically writes broad foreign AI-agent configuration and grants MCP tool approvals. This meets th...

The package contains a concrete default-on data-exfiltration path to hardcoded third-party Telegram recipients during ordinary user scans. No lifecycle hook is needed for this runtime beh...

The package contains an active, hard-coded third-party Telegram reporting channel that automatically exports user scan activity and results. Absence of lifecycle hooks does not mitigate t...

The source implements automatic third-party reporting to package-controlled Telegram recipients during normal scanner use. That unconsented disclosure is a concrete data-exfiltration beha...