npm detections from LPM Firewall.

This is concrete install-time mutation of foreign AI-agent control files, not merely interactive first-party setup. The hidden quiet path also bootstraps and executes remote code.

The install-time mutation targets a foreign, broad AI-agent control surface and is unconsented. Managed-target safeguards do not remove the initial automatic injection.

The postinstall hook performs a concrete, persistent write outside its own package into a dependency's OAuth UI. Under the install-control-surface policy, this warrants blocking despite t...

The forced newsletter follow is concrete, runtime-reachable account manipulation, and fixed-recipient Telegram reporting creates a conditional data-exfiltration path. These behaviors are...

Source inspection confirms a hard-coded third-party credential receiver in the normal runtime login path. No lifecycle hook is needed for this concrete credential-exfiltration behavior.

Although the bundled skill is documented and appears qgrid-specific, the postinstall hook automatically replaces foreign project and user-wide agent skill locations. That concrete install...

Source establishes a concrete default credential-exfiltration path to an endpoint unrelated to Facebook, activated by ordinary package use. No lifecycle hook is needed for the harmful beh...

The source establishes a concrete credential-exfiltration path to a package-controlled default datastore, not merely a legitimate user-selected backend. Shared-database job polling also g...

Source inspection confirms an unconsented postinstall modifies broad, foreign AI-agent configuration and installs persistent event hooks/extensions. This meets the install-control-surface...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, matching the block boundary. The lack of an install-time network call does not mitigate th...

The confirmed postinstall path automatically installs package-controlled agent instructions into multiple third-party/global agent directories. This meets the block policy for unconsented...

The install hook performs unconsented mutation of foreign AI-agent control files and consumer build configuration. This meets the policy boundary for a publish block despite no observed n...

The install-time, default cross-agent mutation meets the firewall block policy even though no exfiltration endpoint was confirmed. The documented behavior and installer source directly su...

Source directly establishes a default external credential receiver and sends authentication material to it during normal login. No lifecycle hook is needed for this concrete runtime crede...

The lifecycle behavior is concrete and automatic, not merely dormant tooling. Although shared agent-config migration is opt-in and no exfiltration was found, unprompted remote-script exec...

This is concrete unconsented postinstall mutation of foreign, global AI-agent control surfaces. The later provider calls are not needed for the block decision.

The guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeo...

The package has legitimate relay functionality, but its global postinstall mutates foreign Codex and Claude control surfaces, including a default agent profile. This meets the block bound...

Source inspection confirms hard-coded third-party uploads of project files and system identity data, including config files that the CLI treats as credential-bearing. The postinstall scaf...

The package contains a concrete, concealed, remotely controlled action against the user's authenticated account during ordinary runtime. The benign lifecycle/version check and scoped medi...

The package performs unconsented postinstall mutation of a consuming project’s broad AI-agent control surface, including deletion of existing agent configuration. This meets the firewall...