npm detections from LPM Firewall.

The package performs concrete global postinstall rewrites across multiple third-party AI-agent control surfaces. That meets the firewall block boundary despite the absence of observed exf...

Although npm installation itself has no lifecycle hook, the package’s intended installed runtime automatically sends collected work-report data to a hardcoded external IP by default. This...

This is a concrete install-triggered C2 and remote-control chain, not merely a bundled desktop application. The lifecycle hook runs it without an explicit user command.

Concrete runtime credential exfiltration to an unrelated endpoint is present. Lack of lifecycle hooks does not mitigate the activated payload.

The package contains a concrete automatic remote exfiltration path for potentially credential-bearing account configuration. Its package-local postinstall behavior does not mitigate this...

This is concrete credential exfiltration triggered by normal module import, with obfuscation and self-removal for concealment. The legitimate codec exports do not mitigate the appended ma...

Concrete, default-enabled export of collected developer activity to a hard-coded external endpoint establishes data exfiltration. The lack of an npm install lifecycle hook does not mitiga...

Source inspection confirms the flagged lifecycle behavior directly. The global Claude Code command installation meets the blocking policy even though no exfiltration was found.

This is concrete default-on data exfiltration to a hardcoded public receiver after installation, not merely a user-configured reporting feature. The absence of an npm install lifecycle ho...

Source inspection confirms the policy-defined blocking condition: an unconsented postinstall mutates multiple foreign/broad AI-agent skill locations. The opt-out environment variable does...

The package performs unconsented postinstall delivery and installation of an unsigned remote native payload while explicitly aiming to bypass SmartScreen/Gatekeeper behavior. Hash verific...

Source confirms conditional but automatic upload of environment secrets to a fixed default external endpoint. The absence of lifecycle hooks reduces install-time risk but does not remove...

The global-install guards reduce scope but do not establish user consent for changing Claude Code configuration. This matches the blocking policy for install-time mutation of a foreign AI...

The concrete automatic credential-transfer path to a fixed external receiver is sufficient for a block verdict. The lack of install hooks limits the trigger but does not remove the CI exf...

The lifecycle hook directly reaches both foreign AI-agent skill writes and persistence. Although no credential theft or remote payload execution was found, the postinstall control-surface...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, which meets the upstream firewall block policy. No exfiltration was found, but it does not mitigate the...

The package has a concrete unconsented postinstall remote-code-execution chain. Vendor-named endpoints and opt-outs do not remove the install-time execution risk.

The postinstall hook performs unconsented mutation of foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface bloc...

The lifecycle hook performs broad, persistent AI-agent configuration mutation in a consuming project and changes package-manager lifecycle behavior. This meets the install-time foreign/br...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces during global installation. Under the stated policy this is block-worthy even without sep...

The package embeds a default external receiver and transmits operational records without an explicit consumer opt-in at the call site. The absence of install hooks limits the trigger but...