npm detections from LPM Firewall.

The lifecycle code concretely installs, executes, and patches a separate AI-agent package during npm installation. This meets the blocking policy for unconsented postinstall mutation of a...

This package performs unconsented install-time remote native-code acquisition with a caller-controllable source and non-independent integrity check. That forms a concrete postinstall remo...

The lifecycle hook performs broad AI-agent configuration rather than a package-owned setup. The direct Codex approval mutation and Claude hook installation establish a concrete control-su...

The package performs concrete privileged persistence and weakens remote-access controls automatically during npm installation. This is malicious behavior, not a benign installer primitive.

The package performs unconsented postinstall configuration of Cursor's user-wide MCP and command surfaces. This meets the install-control-surface block policy despite the global-install g...

The package contains a concrete, obfuscated staged-payload loader that executes unvalidated cached code. Its inert postinstall hook does not mitigate the runtime arbitrary-code-execution...

The postinstall hook performs unconsented, default-target installation into Cursor’s global skills directory. This meets the install-time foreign AI-agent control-surface mutation block p...

The package contains concrete runtime credential-disclosure and automatic remote logging behavior, plus embedded fallback secrets and global TLS bypass. The absence of install hooks limit...

Source directly confirms an automatic elevated postinstall chain that creates hidden privileged RDP access and weakens RDP security. Lack of exfiltration does not mitigate the concrete re...

This is concrete unconsented postinstall mutation of global Claude/Codex control surfaces, including a recurring Codex notify hook. The existing-notify safeguard does not remove the unsaf...

Source inspection confirms an automatic postinstall that changes global Claude/Codex configuration and registers a Codex lifecycle hook. This meets the policy threshold for blocking uncon...

Source confirms automatic postinstall mutation of multiple foreign AI-agent control surfaces, including enabling a Codex plugin. This meets the block criterion despite no observed install...

The package has concrete postinstall mutation of foreign, broad AI-agent control surfaces, including a command-executing Claude hook. This meets the install-control-surface block boundary...

The source confirms an automatic postinstall chain that installs global AI-agent assets and configures Codex notify execution. This meets the blocking install-control-surface policy regar...

The install lifecycle automatically writes and configures both generic and Claude-specific agent controls in the consumer project. This meets the blocking policy for unconsented postinsta...

The package exports a bundle containing targeted, automatically activated page disruption and external audio playback. Absence of install hooks does not mitigate the runtime attack behavior.

This is concrete unconsented install-time remote payload execution, not merely a user-invoked setup feature. Opt-in shared-path migration does not mitigate the default remote installer an...

Source establishes a concrete runtime credential disclosure to a hard-coded external endpoint. No install-time hook is involved, but the user-triggered route provides a direct exfiltratio...

Direct source inspection confirms immediate, non-user-invoked reverse-shell behavior in the runtime entrypoint. Absence of lifecycle hooks does not mitigate import-time remote command acc...

The package’s postinstall mutates broad, foreign AI-agent control surfaces and registers an MCP integration without consent. Localhost-only networking does not mitigate this install-time...

Concrete postinstall persistence targets a broad, foreign AI-agent configuration and registers package-controlled command execution. No exfiltration is needed for this policy violation.