npm detections from LPM Firewall.

Source confirms an unconsented postinstall mutation of multiple foreign/broad AI-agent control surfaces, which meets the blocking policy. The package-aligned skill content and checksum ch...

The source confirms a concrete postinstall mutation of several foreign/broad agent control surfaces, meeting the block policy. The benign-looking skill content and checksum check do not r...

The installer directly performs broad, persistent global agent-control-surface writes during postinstall. User-invoked network/credential tooling does not negate that install-time behavior.

This is concrete unconsented postinstall mutation of a shared/foreign AI-agent credential surface, not a user-invoked migration. The competing-service marker deletion and credential repla...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, meeting the blocking policy. Optional local-only MCP transport does not mitigate the install-...

The lifecycle script performs broad cross-vendor agent configuration and MCP registration without explicit user setup. Local-only networking and the apparent browser-automation purpose do...

The lifecycle hook performs persistent global Claude Code command installation, which meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent co...

The package performs unconsented postinstall mutation of a foreign AI-agent configuration and enables external agent control channels. This meets the firewall blocking boundary even thoug...

This is a concrete unconsented install-time mutation of broad foreign AI-agent control surfaces. Guardrails and lack of observed exfiltration do not remove that attack surface.

Source confirms a concrete, default-enabled external data-exfiltration chain after installation. The configurable UI does not negate the unsafe preconfigured destination and interval.

The hardcoded, default-enabled external reporting endpoint plus collection of Claude and Git work metadata establishes concrete unconsented data exfiltration. This is not justified by an...

Source establishes a concrete, default-enabled outbound collection chain to a hard-coded public endpoint. Although npm itself has no install lifecycle hook, the package’s explicit install...

The lifecycle hook performs automatic cross-agent configuration mutation, meeting the block boundary for a foreign/broad AI-agent control surface. No exfiltration was confirmed, but it is...

The automatic lifecycle script performs destructive credential/config mutation and credential replacement in a shared AI CLI directory. Package-aligned networking does not mitigate the un...

Source confirms the critical behavior rather than merely scanner hints: an automatic npm postinstall modifies global Claude configuration and injects a mutable MCP launch command. This me...

This is a concrete unconsented postinstall mutation of broad AI-agent control files in the consumer project. The templates appear design-system-oriented and no exfiltration was found, but...

Source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. Guardrails around filesystem boundaries do not remove...

This is a concrete unconsented postinstall write to foreign project-root AI-agent instruction files. The absence of exfiltration does not remove the policy-defined control-hijack behavior.

This is a concrete, unconsented postinstall mutation of foreign AI-agent control files. Lack of exfiltration does not remove the control-surface compromise.

This is concrete unconsented postinstall mutation of foreign, global AI-agent configuration and lifecycle controls. It meets the firewall block boundary even without postinstall network a...

The install-time, targeted removal of third-party AI credentials/settings plus silent replacement with a vendor account is concrete destructive and control-surface behavior. This exceeds...