npm detections from LPM Firewall.

Direct source inspection confirms unconsented install-time host-fingerprint exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Source confirms an unconsented install-time mutation of a broad, foreign AI-agent control surface. Per policy, this is a publish-block condition despite the absence of credential exfiltra...

Direct source inspection confirms an automatic install-time credential-exfiltration chain with no package-aligned purpose.

The package implements unconsented install-time secret collection and external exfiltration. Its comments and error suppression do not alter the concrete behavior.

Direct source inspection confirms install-time credential collection and external exfiltration, unrelated to the claimed AMM contracts/ABIs package.

This is unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the block boundary. No exfiltration or remote payload is needed for this concrete control-surface at...

Source confirms an unconsented postinstall mutation of ~/.agents/skills, a foreign/broad AI-agent control surface. This meets the blocking policy regardless of the unrelated CLI and Git-h...

The credential storage and remote job channel are reachable during ordinary runtime and use a package-default endpoint, not an installer-owned configuration. This is concrete exfiltration...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote executable retrieval and host-level configuration changes. The global-install...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, compounded by unauthenticated remote binary execution and host configuration changes.

This is an unconsented install-time remote-code-execution chain. The package contains no local installer payload to inspect or integrity control for the script it executes.

The automatic remote executable/wheel chain is paired with deliberate concealment and post-install rewriting, establishing a concrete stealthy staged-payload behavior. Embedded hashes do...

The package performs concrete, cross-platform login persistence from postinstall, rather than only when a user invokes its CLI. Its background server also binds broadly by default, increa...

Source establishes a concrete collection-and-upload chain for foreign AI-agent session/state data. No install hook reduces install-time impact but does not negate runtime exfiltration.

This is concrete cross-agent data collection and remote upload, not merely user-requested local command execution. The lack of install hooks limits installation impact but does not remove...

This is concrete, unconsented postinstall mutation of multiple foreign AI-agent control surfaces, meeting the blocking policy. The absence of a hard-coded exfiltration host does not remov...

Direct inspection confirms an install-time credential/system-data exfiltration chain. This is concrete malicious behavior, not a scanner-only inference.

This is a concrete postinstall-time mutation of foreign/broad AI-agent control surfaces, including automatic Codex plugin enablement. The absence of install-time networking does not remov...

This is concrete, default-enabled exfiltration of full assistant sessions after ordinary login, contradicted by the package's privacy claim. The install hook itself is non-malicious.

The lifecycle hook performs active AI-agent configuration and hook installation in the consumer project without an explicit user command. This meets the blocking policy even though no net...