npm detections from LPM Firewall.

This package performs unconsented install-time staging of unverified remote executables and establishes a later execution/update chain. That is a concrete remote-payload execution risk, n...

Source establishes import-time child-process launch followed by obfuscated network retrieval and dynamic execution. Absence of lifecycle hooks does not mitigate this runtime backdoor.

Source confirms default remote transmission of GitHub Actions identity credentials and runtime secrets to a package-controlled endpoint. The absence of install hooks does not remove this...

Source inspection confirms an unconsented postinstall mutation of broad Claude project controls, plus a telemetry chain that accesses session metadata and transcript-derived usage. This m...

Direct source inspection confirms concrete credential/session theft and exfiltration behavior in index.js. The lack of lifecycle hooks limits automatic activation but does not negate the...

The payload implements concrete credential harvesting and exfiltration, not merely risky primitives. Lack of an install hook limits automatic activation but does not make the directly exe...

The package’s proxy behavior is plausible, but automatic daemon startup and login persistence during postinstall are concrete harmful behavior outside an explicit user action.

This is a concrete, default-enabled external logging/exfiltration path for rich host application data, not merely a generic HTTP capability. No installation hook is needed for the runtime...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent configuration and permission surfaces. This meets the firewall block boundary regardless of t...

The package’s install hook establishes background persistence and its control-plane code can transmit workspace artifacts to a hard-coded plaintext endpoint. This is a concrete malicious...

The postinstall hook concretely deletes foreign AI runtime packages during installation. Global-only scope and opt-outs reduce breadth but do not make the unconsented lifecycle mutation s...

This package disguises a backdoor ELF as a native calendar-math accelerator and executes it at import time. No lifecycle hook is needed for the concrete malicious runtime chain.

The source establishes an immediate remote-payload execution chain; no legitimate package functionality is present to justify it.

The package performs unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the firewall block boundary even though no install-time exfiltration was found.

Source inspection confirms an unverified, environment-configurable payload loader executed during postinstall. The shipped public module does not implement the README's TWAP functionality...

The shipped API does not need this installer, while its postinstall executes a remotely controlled dependency payload. This is concrete install-time remote code execution.

Source inspection confirms a concrete privileged remote-access persistence chain activated by postinstall, not merely a risky utility. Documentation does not make automatic hidden-account...

Source confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the firewall block policy regardless of the installer’s lack of network activ...

This is unconsented postinstall mutation of foreign/broad AI-agent environments, coupled with remote native payload installation. The source establishes the behavior directly.

Direct inspection found a concrete, undocumented third-party callback mechanism in the shipped executable. No install hook is needed for the runtime data-exfiltration risk to activate.

The postinstall hook performs concrete, unconsented collection and external transmission of local machine/user metadata. The benign-looking runtime analytics code does not mitigate this i...