npm detections from LPM Firewall.

This is concrete credential exfiltration in a normal runtime initialization path, despite no install-time lifecycle hook. The scanner similarity is unnecessary to the verdict.

Source inspection confirms a concrete runtime data-exfiltration path in both distributed entrypoints. The absence of install hooks does not mitigate the malicious library-call behavior.

This is a concrete import-time malware execution chain, not a legitimate math accelerator. Absence of an npm lifecycle hook does not mitigate execution when the package is imported.

Source confirms an unguarded npm postinstall mutates Claude Code configuration in the consumer project and runs pip installation. This meets the install-control-surface block policy despi...

The source implements a concrete staged remote-code-execution path, despite requiring an explicit exported-function call. Its declared utility purpose and documentation do not justify thi...

The postinstall creates a foreign, global Claude Code control surface rather than limiting setup to an explicit CLI command or the target project. This meets the blocking policy despite n...

Source establishes a direct remote logging sink and sensitive account/configuration inputs reaching it. The absence of lifecycle hooks does not mitigate the runtime exfiltration behavior.

Concrete lifecycle code modifies global ~/.claude settings and installs a command invoked by all Claude Code sessions. No network exfiltration is needed for this policy-defined install-ti...

This is unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. The absence of observed exfiltration does not remove the concrete persistent control-surface imp...

Direct inspection establishes an install-triggered surveillance and remote-control chain, plus optional persistence. This is concrete malicious behavior, not a noisy binary-artifact signal.

The source implements concrete, unconsented install-time host-data exfiltration to external endpoints. The stated research purpose does not remove the active collection and transmission b...

The package performs unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the blocking policy even though the inspected statusline contains no network...

This is a concrete install-time broad AI-agent control-surface mutation, which meets the blocking policy. Guardrails and lack of network exfiltration reduce collateral risk but do not rem...

Source confirms automatic postinstall mutation of broad foreign AI-agent skill directories, including a remotely fetched mutable skill. This meets the blocking policy for unconsented life...

Source confirms an npm postinstall automatically injects package-controlled Claude Code skills into the consumer project and runs pip provisioning. This is concrete unconsented install-ti...

The package adds an unrelated preinstall loader that downloads and executes remote content, including a hard-coded mirror and time-gated fallback. This is concrete install-time remote cod...

The package has a concrete unconsented postinstall mutation of the global Claude Code control surface and installs a command that runs across all sessions. Lack of observed network exfilt...

The package deliberately exfiltrates caller-supplied decode input to an unrelated endpoint in both distributed entrypoints. This is concrete runtime data exfiltration, despite no install-...

A base encoding library has no legitimate need to transmit every decode input to an unrelated IP address. The concrete, duplicated runtime exfiltration behavior warrants blocking.

The automatic postinstall mutation of third-party AI-client MCP configurations meets the blocking policy. Remote native payload installation, persistence, and telemetry compound the contr...

The package has no install hook, but its normal agent runtime embeds covert collection instructions and tools that harvest sensitive user context. The behavior is concrete and exceeds a u...