npm detections from LPM Firewall.

The lifecycle hook creates persistent, cross-client agent-control changes during installation, meeting the blocking policy. No network exfiltration is needed for this concrete control-sur...

This is concrete, unconsented postinstall mutation of a broad foreign AI-agent configuration surface. It meets the firewall block criterion regardless of otherwise normal CLI and bundled-...

Source confirms an unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the install-control-surface block boundary regardless of the optional opt-out...

Source inspection confirms concrete automatic mutation of ~/.agents/skills through a postinstall hook. This meets the blocking policy for unconsented postinstall changes to a foreign/broa...

The confirmed postinstall global AI-agent skill installation meets the blocking policy. Runtime daemon helpers do not reduce that install-time risk.

This is a concrete, unconsented postinstall mutation of a foreign/broad AI-agent control surface. The opt-out environment variable does not make the default install behavior consensual.

The postinstall hook performs unconsented mutation of a foreign, broad AI-agent control surface. This meets the install-control-surface block boundary.

Source inspection confirms an unconsented postinstall operation that installs third-party skills globally into ~/.agents/skills/. Opt-out and non-fatal handling do not make the mutation u...

Source inspection confirms an unconsented postinstall write to a foreign AI-agent skills directory through a remote npx command. This meets the install-control-surface block policy.

The harmless postinstall chmod does not mitigate the runtime unverified executable-fetch path. This creates a concrete remote-code-execution surface rather than a merely suspicious primit...

The payload is concrete, targeted, import-time disruptive behavior unrelated to a dynamic-column React component. Absence of install hooks does not remove the browser-runtime attack surface.

This is a concrete, concealed credential-exfiltration chain activated by ordinary CLI use. The lack of install hooks does not mitigate the undisclosed default remote upload.

Source directly establishes concealed default credential exfiltration and remote subscription-use behavior. The lack of an install hook does not mitigate the malicious runtime payload.

This is concrete, unconsented credential exfiltration triggered by normal CLI use, not merely proxy functionality. Absence of an install hook does not mitigate the runtime theft behavior.

This is concrete, unconsented credential exfiltration activated by normal CLI use, not merely an explicit user-configured proxy feature. The absence of an npm lifecycle hook does not miti...

Source establishes credential exfiltration to a remote hub configured through the package's command surface. No install hook is involved, but the undisclosed backup behavior is concrete a...

This is a concrete unconsented lifecycle-chain mutation of persistence and a foreign AI-agent launch surface, not merely dormant CLI capability.

The lifecycle installer stages a remote native payload while intentionally evading platform trust protections. Hash checking does not mitigate the package author's deliberate delivery and...

The automatic native-payload install is explicitly designed to bypass host download-security controls, then persists the payload through OS integration. Digest checking does not mitigate...

This is a concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces. The absence of exfiltration does not remove the install-time control-hijack behavior.

This is concrete install-time screen-data exfiltration via a bundled executable and JAR.