npm detections from LPM Firewall.

The package has a concrete npm postinstall path that can mutate foreign Claude control files without affirmative consent. This meets the install-control-surface block policy despite the f...

Runtime behavior establishes concrete credential exfiltration to a package-supplied remote datastore; it is not required for a local WhatsApp bot. The preinstall hook is unrelated and doe...

Source inspection confirms the lifecycle script deploys package-controlled instructions across multiple unrelated agent platforms. This satisfies the firewall block criterion for unconsen...

Source confirms an automatic postinstall modifies foreign global Claude/Codex configuration and installs a future Codex lifecycle hook. This meets the blocking policy for unconsented inst...

Direct source inspection confirms unconsented install-time collection and external transmission of local system data. This is concrete credential/system-data exfiltration behavior.

Direct source inspection confirms install-time global AI-agent configuration changes, including a default agent routing profile. The global-only guard and loopback endpoint reduce unrelat...

The package's documented purpose does not change that npm postinstall performs unconsented writes across a broad set of foreign AI-agent configurations. This meets the blocking policy for...

Source confirms a default third-party credential-forwarding flow activated during normal login recovery. The absence of install hooks does not mitigate runtime credential exfiltration.

The confirmed postinstall behavior is unconsented mutation of foreign AI-agent configuration, meeting the blocking policy. No additional exfiltration is needed for this verdict.

No npm install hook executes this behavior, but the shipped extension’s default configuration creates a concrete credential-exfiltration path when users use its advertised password-manage...

Concrete install-time mutation of a project AI-agent control surface is paired with a shipped token-capture-and-send workflow to an unrelated fixed endpoint. This meets the blocking thres...

Source confirms unconsented install-time mutation of Codex's global provider and default-agent control surface. That concrete behavior meets the blocking policy despite the loopback endpo...

This is a concrete, unconsented postinstall mutation of a broad foreign AI-agent control surface. The declared feature does not remove the installation-time control-hijack risk.

Source confirms a credential-bearing request to a hardcoded non-Facebook host, including an automatic runtime path. The lack of install hooks does not mitigate this concrete credential-ex...

The package has a concrete unconsented postinstall chain that alters broad AI-agent configuration, including the default Codex agent. Its otherwise package-aligned proxy behavior does not...

The package has a concrete postinstall persistence mechanism targeting ~/.codex/skills, not merely an explicit CLI setup command. Disclosure and an opt-out do not remove the unconsented l...

This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unaut...

The concrete postinstall behavior meets the block boundary: unconsented mutation of foreign/broad AI-agent control surfaces. The absence of direct exfiltration does not mitigate this inst...

The package contains a concrete, default-enabled credential upload path reachable during normal CI execution. Documentation describes a vault, but does not remove the security impact of a...

The package’s advertised proxy functionality is bundled with an automatically activated, hard-coded remote administration channel that provides command execution and unrestricted file acc...

Direct source inspection confirms an intentional browser data-exfiltration payload and deceptive UI. Lack of an install hook reduces automatic reachability but does not negate the concret...