npm detections from LPM Firewall.

The lifecycle script directly installs package-controlled instructions into the user's Claude skill directory. This meets the block threshold for unconsented postinstall mutation of a for...

The package performs concrete postinstall mutation of a consuming project's Claude Code configuration and extension directories. This meets the block boundary for unconsented install-time...

The lifecycle hook performs automatic, persistent writes to foreign Claude Code and Codex skill registries, which meets the install-time AI-agent control-surface hijack boundary. Detectio...

The lifecycle hook performs unconsented install-time mutation of a consumer AI-agent control surface, meeting the blocking policy. Source inspection found no separate exfiltration or remo...

Source confirms a lifecycle-reachable, automatic write into consumer .agents and .git/hooks. This meets the blocking policy for unconsented install-time mutation of a foreign/broad AI-age...

The package has a concrete, automatic postinstall chain that mutates foreign AGENTS.md/CLAUDE.md files and consumer build scripts. This meets the block criterion for unconsented postinsta...

This is an unconsented install-time mutation of a broad AI-agent control surface, which meets the firewall block boundary. The absent default template limits default activation but does n...

The unconsented postinstall overwrite of root AGENTS.md is a foreign, broad AI-agent control-surface mutation. Remote code updates in the rewritten build path reinforce the supply-chain r...

Source inspection confirms an automatically activated, obfuscated browser cryptominer rather than a package-aligned utility. The absence of a consumer install hook does not mitigate runti...

The lifecycle hook is benign, but runtime source establishes concealed, automatic modification of outbound user media with package-controlled newsletter metadata. This is concrete decepti...

The behavior is concrete, install-time, unconsented mutation of broad foreign AI-agent control surfaces and permissions. No external exfiltration was needed to establish the blocking cond...

The package performs the prohibited chain directly: npm postinstall silently mutates multiple AI-agent configurations and installs intercepting hooks. The absence of exfiltration does not...

The lifecycle chain is concrete and automatic: postinstall invokes initialization that persists registrations, approval changes, and enforcement hooks across unrelated AI-agent configurat...

The automatic postinstall mutation of ~/.agents, ~/.claude, and ~/.codex meets the block policy for an unconsented broad AI-agent control-surface write. No additional exfiltration is need...

This is concrete runtime data exfiltration through automatic clipboard collection and remote POSTs, supplemented by screenshot upload capability. The absence of lifecycle hooks does not r...

The lifecycle script performs concrete, automatic writes to Claude and Codex hook configuration, rather than merely offering an explicit setup command. That meets the blocking policy for...

The package performs unconsented install-time remote payload execution and writes remotely acquired agent skills. This is a concrete supply-chain execution surface, not merely a user-invo...

The package performs concrete, automatic postinstall mutation of broad foreign AI-agent control surfaces on global installation. That behavior meets the stated publish-block boundary.

Direct source inspection confirms an install-triggered write to Claude Code's global settings that registers broad command hooks. This meets the policy's concrete AI-agent control-hijack...

The source establishes a concrete, automatic credential-transfer chain to a fixed external receiver. Documentation frames this as vault migration, but it does not remove the unconsented e...

The package contains a concrete automatic secret-upload path to a fixed remote host. The absence of install hooks reduces scope but does not negate the runtime credential exfiltration beh...