npm detections from LPM Firewall.

This package has no library functionality: its sole entrypoint is a fake verification HTML page with an automatic, remote-controlled concealed redirect. That is concrete malicious browser...

The package performs an unconsented postinstall mutation of foreign AI-agent control surfaces and force-removes prior content first. No additional exfiltration was needed to meet the inst...

The package’s global postinstall directly installs persistent command hooks into Claude Code’s user configuration and launches background persistence. This meets the block threshold regar...

The package contains a concrete, default-enabled external upload of environment secrets during GitHub Actions runtime. Absence of install hooks lowers lifecycle risk but does not remove t...

This meets the install-control-surface block criterion: unconsented postinstall mutation of broad foreign AI-agent configurations. Runtime provider networking appears feature-aligned and...

Direct source inspection confirms automatic cross-platform agent configuration writes plus Claude Code permission expansion during postinstall. This meets the install-control-surface bloc...

The package contains a guarded but real postinstall path that performs privileged database administration against an embedded remote endpoint. This exceeds a UI theme library's expected b...

The package has a concrete install-time chain that silently modifies ~/.claude/settings.json and registers execution hooks. This meets the block policy for unconsented postinstall mutatio...

Source establishes an automatic, concealed third-party transfer of inbound photo attachments during normal chat-listening operation. The absence of install hooks does not mitigate this ru...

The source establishes a fixed default receiver, serializes secret values into a PUT request, and invokes that upload automatically in GitHub Actions. Absence of lifecycle hooks does not...

The package performs concrete automatic postinstall writes to Claude Code's global configuration and overrides its status line. Guard conditions and an npm update check do not remove that...

The automatic postinstall hook performs forced, recursive writes to both Codex and Claude Code skill locations. That concrete unconsented mutation meets the install-time foreign AI-agent...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and machine-identity cloud registration. The global/macOS guards...

The concealed post-verification redirect and wholesale query forwarding are concrete browser-side attack behavior, not package-aligned functionality. It does not execute during npm instal...

This is concrete, unconsented postinstall mutation of foreign and broad AI-agent control surfaces, including permission settings. No network exfiltration is needed for the install-control...

This is an unconsented postinstall mutation of a foreign, global AI-agent control surface. The OAuth code is user-invoked and does not mitigate the install-time persistence.

Source directly confirms automatic, cross-agent skill installation during npm postinstall. This meets the blocking policy regardless of the absence of network activity in that lifecycle s...

Hardcoded default webhook destinations combined with automatic rich runtime logging form a concrete exfiltration chain. The absence of install hooks does not mitigate this application-run...

Although no network exfiltration was found, the package concretely performs unconsented postinstall mutation of broad third-party AI-agent control surfaces. This meets the firewall block...

This is a concrete unconsented npm postinstall mutation of a foreign AI-agent control surface. The conditional hook/MCP path does not mitigate the unconditional skills write.

The source establishes unconsented install-time host fingerprint exfiltration and system mutation, not merely dormant capability. The telemetry endpoint is identifiable, but that does not...