npm detections from LPM Firewall.

A hardcoded non-package endpoint receives automatically collected work and Claude-session data by default. The absence of an npm lifecycle hook does not remove the concrete post-install e...

This is concrete, unconsented postinstall mutation of foreign/broad AI-agent control surfaces. The lack of an install-time exfiltration request does not remove the control-hijack risk cre...

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

The package performs unconsented postinstall mutation of a foreign AI-agent control surface for rebranding. Runtime authentication behavior does not mitigate that install-time tampering.

The package has a concrete, default postinstall remote-payload execution chain and stages unpinned externally fetched skills for activation. Opt-in protection for shared-path migration do...

This is concrete install-time mutation of a foreign AI-agent control surface, coupled with routing users to the package vendor's provider. The authentication network traffic is package-al...

The postinstall hook executes a remotely supplied shell script whose archive and checksum share the same mutable trust source. This is a concrete install-time remote-code-execution chain,...

The concrete postinstall mutation of a foreign AI-agent dependency meets the install-control-surface block boundary. Network and credential code is package-aligned, but does not mitigate...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain is required for this verdict.

Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-tim...

Source directly shows silent remote transmission of account configuration, including a serialized IMAP object, to a non-provider logging endpoint. The package's benign workspace postinsta...

The observable purpose is a keyboard notification utility, but its npm postinstall automatically injects executable hooks across third-party AI-agent configurations. That meets the firewa...

Source confirms a default third-party credential receiver in the standard runtime login path. Absence of install hooks does not mitigate this concrete credential-exfiltration behavior.

This is a concrete remote-code-execution loader disguised as a Tailwind plugin. Absence of an install hook limits the trigger but does not mitigate execution when the exported plugin is u...

The package's stated placeholder purpose does not require automatic external telemetry. Its postinstall beacon exfiltrates host-derived data through both HTTPS and DNS.

Direct inspection confirms the critical behavior is the guarded but automatic postinstall mutation of multiple foreign AI-agent control surfaces. The scanner's fixed-gateway credential-ex...

The confirmed postinstall mutation of ~/.claude/skills meets the policy threshold for an unconsented foreign/broad AI-agent control-surface write. The reverse-shell and credential-exfiltr...

The import-time updater silently installs a mismatched remote package into the caller's project. This is concrete unconsented remote code execution behavior, not a normal user-invoked upd...

The payload executes on package import and has a concrete network-to-eval-to-detached-process chain. The absence of lifecycle hooks does not mitigate import-time arbitrary code execution.

This is concrete, unconsented install-time privileged system mutation that creates a concealed remote-access path. The absence of observed exfiltration does not mitigate the backdoor beha...

The install-time behavior is unconsented and materially changes host authentication and network exposure. The absence of outbound JavaScript networking does not mitigate the local backdoo...