npm detections from LPM Firewall.

The automatic lifecycle chain performs concrete privileged persistence and remote-access-enabling changes, including stealth measures. This is malicious behavior, not a package-aligned in...

This is concrete unconsented postinstall host compromise behavior, not a package-aligned setup action. No network exfiltration is needed for the package to establish stealthy privileged r...

The lifecycle hook causes these privileged, security-weakening changes without an explicit user command. The absence of observed exfiltration does not mitigate the concrete backdoor-like...

The package’s postinstall automatically modifies detected Claude Code and Codex hook configuration. This meets the blocking policy for unconsented install-time mutation of foreign AI-agen...

The source confirms install-time mutation of multiple foreign AI-agent skill locations. The global-install guard reduces reach but does not make the mutation consensual. Product guard nor...

The postinstall lifecycle hook performs unconsented mutation of broad, foreign AI-agent control surfaces and installs a remote dependency. This meets the blocking policy regardless of the...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the install-control-surface block policy even though no install-time network...

The package performs an unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. Registry-only update checking and credential filtering do not mitigate that inst...

The postinstall hook concretely injects MCP launch configuration into multiple third-party editor directories under the consumer project. This meets the install-time foreign/broad AI-agen...

The package’s install hook performs concrete writes to detected third-party AI-agent configuration roots rather than limiting setup to an explicit CLI command. This matches the blocking i...

The postinstall hook performs unconsented global AI-agent command installation. This meets the firewall block condition even though the visible payload is static and no network or credent...

Direct inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking policy irrespective of the absence of confirmed credential...

The package performs automatic postinstall writes into Claude Code, Codex, and opencode skill paths. This meets the firewall block boundary for unconsented install-time mutation of foreig...

This is a concrete unconsented postinstall mutation of multiple third-party AI-agent control surfaces, meeting the block boundary. The bundled native binaries are opaque but are not requi...

This is a concrete unconsented postinstall mutation of broad third-party AI-agent control surfaces combined with credential reuse and prompt exfiltration. It meets the package firewall bl...

This is concrete, lifecycle-reachable mutation of several foreign AI-agent configurations, not an explicit user setup command. The additional credential-handling and remote defaults incre...

The lifecycle hook concretely performs broad, unconsented AI-agent configuration and persistence, meeting the blocking policy regardless of the absence of a bundled remote endpoint.

The package has a concrete, automatic postinstall chain that writes a bundled skill into detected third-party agent directories. Under the firewall policy, this requires a publish block r...

Source confirms automatic postinstall writes to existing foreign AI-agent configuration and command-hook surfaces. This meets the block boundary regardless of the absence of observed cred...

Source confirms an install-time mutation of foreign AI-agent command names and a subsequent credential-routing, persistent full-access configuration chain. Collision checks reduce acciden...