npm detections from LPM Firewall.

The lifecycle hook combines remote content retrieval with automatic writes and deletions in foreign global agent configuration directories. This meets the block policy for unconsented pos...

The confirmed postinstall behavior is unconsented mutation of foreign and broad AI-agent control surfaces, with a remote-sourced skill propagated into them. This meets the install-control...

This is a concrete, unconsented install-time credential-harvesting and internal-reconnaissance chain, not package-aligned runtime health behavior.

The package contains an unconsented install-time remote code-execution chain. Its runtime safeguards do not mitigate this lifecycle behavior.

The package performs a concrete, manifest-triggered postinstall configuration takeover of multiple third-party AI-agent clients. Its global-install guard reduces scope but does not supply...

The lifecycle behavior is concrete and package-controlled: it fetches remote instructions and deploys them to several global agent runtimes. This meets the blocking policy for unconsented...

The source establishes an unconsented postinstall chain that writes package-controlled instructions to broad, foreign AI-agent directories and can source content remotely. This meets the...

Source establishes a concrete stealth, persistence, capture, and remote-submission chain aimed at defeating proctoring. The inert cookie extractor further reinforces malicious intent, tho...

This is a concrete stealth, persistence, capture, and external-submission chain, not a diagnostic utility. The benign postinstall hook does not mitigate the malicious user-executed behavior.

Source confirms a guarded but automatic global postinstall chain that persists executable hooks across multiple third-party agent configurations. This meets the blocking policy for uncons...

This is concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, including automatic tool approval. The absence of exfiltration does not remove the install-ti...

The install hook performs broad, unconsented environment harvesting and writes potentially secret data outside its package directory. Lack of observed network egress does not make the cre...

Source establishes a persistent fixed-endpoint credential setup followed by token-bearing network requests. No lifecycle hook mitigates install-time risk, but it does not remove the crede...

The package has a concrete unconsented postinstall chain that rewrites a foreign AI-agent dependency. That meets the install-control-surface block boundary.

The automatic global installation of Anthropic's Claude Code from this unrelated package is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. This meets t...

A covert, encoded prompt is wired into an automatic agent-control path and directs disclosure of sensitive conversational context. No install hook is involved, but the runtime behavior is...

Source confirms concrete transmission of user command content and an authentication-like token to a remote endpoint. Although there is no install-time hook and the behavior is exam-trigge...

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, including approval escalation and command hooks. It meets the firewall block boundary regar...

This is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm t...

Source confirms an npm lifecycle hook installs and activates a package-controlled plugin in the unrelated global Herdr environment. This meets the install-time foreign AI-agent control-su...