npm detections from LPM Firewall.

The source implements a direct remotely controlled code-execution path; the lack of an install hook only limits activation to runtime use.

The source establishes an unconsented remote logging path that can carry IMAP credentials, not merely package-aligned mail-provider traffic. The benign install hook and local token-gated...

This is a concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Localhost-only transport does not mitigate the install-time cross-agent registration.

The source confirms an unconsented postinstall write to a consumer Claude skill path. That meets the install-time foreign AI-agent control-surface mutation block boundary.

The package contains a default-enabled path that transfers environment secret values to a package-controlled external endpoint during normal GitHub Actions execution. No install hook is r...

The package has no install-time attack, but its obfuscated runtime silently exfiltrates substantial user source content on ordinary tool failures. That is a concrete privacy and data-exfi...

Source inspection confirms a concealed remote-response-to-Function execution chain, not merely suspicious primitives. Absence of lifecycle hooks limits the trigger but does not remove the...

The concrete postinstall behavior satisfies the blocking policy for unconsented mutation of broad foreign AI-agent control surfaces. No network exfiltration is needed for this install-tim...

Source establishes a concrete, default-enabled remote transmission of environment secrets during CI execution. The lack of an install hook does not mitigate this runtime credential-exfilt...

This is a concrete, unconsented postinstall takeover of a broad user-level AI-agent credential/control surface, not merely a runtime feature. The launcher itself is local, but it does not...

This is a concrete, unconsented postinstall mutation of an AI-agent credential/control surface, including destructive replacement of existing configuration. The behavior is not required t...

The main entrypoint performs unconditional remote payload retrieval and dynamic execution. This is a concrete remote-code-execution chain, not a benign network use.

The hard-coded receiver and enabled-by-default periodic export establish concrete unconsented data exfiltration. The lack of an npm install hook does not negate runtime behavior after the...

This is a concrete broad AI-agent control-surface takeover chain, not merely a bootstrapper: it modifies home and project instruction files and executes a remotely obtained native daemon....

Source inspection confirms an import-time detached payload launcher and an obfuscated remote dynamic-code loader. The absence of lifecycle hooks does not mitigate runtime compromise on im...

The runtime-reachable, obfuscated blockchain-resolved loader executes attacker-supplied code and spawns a detached process. The benign postinstall hook does not mitigate this independent...

Source confirms unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the blocking policy regardless of the package's stated workflow purpose.

Source confirms an automatic telemetry path backed by a hard-coded secret, not merely a scanner pattern. The scoped postinstall symlink is not the malicious behavior.

This is concrete default-on data exfiltration of user and repository identity, amplified by cross-agent configuration discovery. Explicit cloud features and guarded CI setup do not mitiga...

The guarded postinstall migration is narrow, but the runtime startup path contains confirmed unattended self-update behavior and destructive deletion of a foreign AI-agent configuration f...

This is a concrete, unconsented npm postinstall mutation of a pre-existing foreign AI-agent control surface. The guards and absence of observed exfiltration do not remove the broad automa...