npm detections from LPM Firewall.

Source establishes a default external receiver and automatic periodic POST of locally collected work data. The absence of an npm lifecycle hook does not remove the concrete exfiltration b...

The install chain concretely rewrites Claude Code configuration from postinstall. That foreign AI-agent hook installation is sufficient for a block verdict under the stated policy.

The lifecycle chain is source-confirmed and mutates ~/.claude/settings.json to execute the package on multiple Claude events. This meets the firewall block policy for unconsented postinst...

The package performs a concrete unconsented postinstall deletion of existing AI credentials/settings selected by competitor markers, followed by automatic replacement credential provision...

This is concrete, unconsented install-time collection and external exfiltration of sensitive host data. The package contains no legitimate implementation that would justify this behavior.

The package has a concrete remote upload path for broadly collected credentials and project data. Explicit command activation and documentation reduce stealth but do not mitigate the unsa...

The concrete postinstall path deletes existing agent credentials/settings and installs new remote-provisioned credentials without consent. The launcher and dormant hooks do not mitigate t...

This is concrete, default-enabled data exfiltration to a hardcoded third-party endpoint after installation. It is not justified by an npm lifecycle hook, but user invocation does not cure...

The package's install-time behavior is not limited to its own state: it modifies user-level Claude hooks and establishes persistence without an explicit follow-up command. This meets the...

Source inspection confirms reachable, targeted disruptive behavior in the distributed browser bundle. The lack of an install hook does not mitigate import-time protestware.

Static source inspection confirms a targeted, delayed browser-disruption payload with a fixed remote media endpoint. No install hook is needed because the malicious code executes when the...

This is concrete install-time spyware and remote-control behavior, not an inert bundled application. The hard-coded endpoint, screen exfiltration, and remote UI automation establish a mal...

This is concrete, unconsented install-time reconnaissance, exfiltration, persistence, and cross-project mutation. The path guard limits targeting but does not make the behavior benign.

The bundle contains concrete, targeted browser-disruption behavior and external audio loading unrelated to its checkout purpose. Absence of an install hook does not mitigate the import-ti...

This is concrete, unconsented install-time reconnaissance and exfiltration rather than a package-aligned function. The environment guard narrows targeting but does not remove the maliciou...

This is concrete unconsented install-time reconnaissance, exfiltration, persistence, and filesystem mutation. The path gate and stated research purpose do not remove the malicious behavio...

The cwd guard narrows targeting but does not make the lifecycle-triggered internal reconnaissance consensual. Collection is retained locally and TLS validation is disabled.

Source confirms a concrete install-time chain of data collection, webhook exfiltration, detached daemon persistence, and cross-build enumeration. The hard-coded environment guard and clai...

This is concrete install-time persistence, cross-tenant reconnaissance, remote exfiltration, and runtime-code modification. The research-oriented comments do not negate the implemented be...

The package contains a concrete, automatic remote-controlled account-manipulation chain. Its benign Node-version preinstall check does not mitigate the runtime behavior.

This is concrete install-time persistence and data exfiltration, with conditional cross-build dependency mutation. The package's research framing and sandbox guard do not make these actio...