npm detections from LPM Firewall.

The source establishes default, recurring remote export of local Claude session content and operational state. Scope limits and opt-outs reduce breadth but do not remove the concrete exfi...

The active lifecycle hook performs destructive credential/config mutation and account provisioning outside an explicit user command. This meets the blocking policy for foreign or broad AI...

The lifecycle script performs concrete, unconsented deletion and replacement of user AI CLI credentials/configuration. Vendor-aligned networking does not mitigate that install-time contro...

Source directly establishes transmission of serialized IMAP configuration, including a supported password field, to a remote logging endpoint. The install hook is unrelated and does not m...

Source inspection confirms a concealed, automatic browser-redirection chain behind a security-verification lure. Absence of install hooks does not mitigate the delivered malicious runtime...

The deceptive UI, intentional concealment, and unconditional forwarding of browser query data to an obfuscated destination establish a concrete exfiltration chain. Lack of install hooks d...

The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.

Direct source inspection confirms a concealed redirect chain, not merely a static scanner signal. Although it has no install hook, its browser payload is concretely deceptive and forwards...

The only declared entrypoint is a deceptive, obfuscated redirector rather than a legitimate npm library. Its runtime behavior establishes a concrete phishing/data-transfer attack surface.

Direct source inspection confirms unconsented install-time remote beaconing and shell execution. The claimed PoC purpose does not remove the concrete behavior affecting every installer.

Direct source inspection confirms unconsented install-time network activity, not merely a static hint. No broader payload behavior was found, but the concrete lifecycle beacon warrants bl...

Source confirms persistent agent-hook installation and default outbound collection to a hard-coded non-domain endpoint. The lack of an npm lifecycle hook reduces install-time risk but doe...

The package’s stated telemetry purpose does not justify default persistent hooks that harvest multiple AI-agent session stores and transmit their metadata to a hard-coded, non-TLS IP endp...

The runtime backdoor performs unconsented, remotely controlled mutations of the user's authenticated WhatsApp account. Lifecycle hooks are benign, but do not mitigate this concrete behavior.

Concrete source establishes automatic credential-bearing configuration exfiltration to an unrelated endpoint. This is malicious despite otherwise package-aligned email and OAuth networking.

Source directly shows unconsented remote transmission of account configuration, including a path that serializes credentials. This is concrete credential exfiltration, not package-aligned...

This is a concrete runtime data-exfiltration path, not merely package-aligned IMAP/OAuth networking. The benign install hook and localhost MCP interface do not mitigate it.

Source directly establishes unconsented runtime credential-capable exfiltration. The install hook itself is benign, but it does not mitigate the Android data-exfiltration path.

The package contains an active runtime path that serializes sensitive IMAP configuration and silently sends it to an unrelated remote logging endpoint. The benign postinstall hook does no...

Source establishes automatic transmission of sensitive account configuration to an unrelated endpoint. The install hook itself is benign, but it does not mitigate the concrete runtime exf...

Source establishes an automatic external transmission of user mail-account metadata, not merely package-aligned mail-provider traffic. The benign lifecycle hook and loopback MCP server do...