npm detections from LPM Firewall.

Source inspection confirms concrete unconsented postinstall deletion and replacement of host AI-agent-related configuration. This meets the blocking policy regardless of the absence of co...

Source directly establishes default-enabled transmission of authentication secrets to a package-controlled third-party endpoint and consumption of its session response. No lifecycle hook...

This is a concrete unconsented postinstall mutation of broad, cross-vendor AI-agent control files in the consuming project. It meets the install-control-surface block boundary despite no...

This is a concrete unconsented postinstall mutation of multiple foreign, global AI-agent control surfaces. Hardened permission defaults do not remove the install-time control-surface take...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the publish-block policy regardless of the absence of exfiltration.

Source confirms an automatic postinstall path that mutates multiple third-party AI-client configurations and establishes remote native-code execution with login persistence. This meets th...

Reviewed lifecycle source confirms concrete install-time deletion and control-surface mutation in the consumer project. This meets the blocking policy regardless of the absence of observe...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, matching the block boundary. The absence of network exfiltration does not mitigate the con...

Source confirms concrete postinstall persistence across unrelated AI-agent configurations, meeting block policy. Network and cookie primitives do not reduce this independent install-time...

This is concrete default-enabled data exfiltration to a package-chosen external endpoint, not merely a user-configured integration. The absence of an npm install lifecycle hook does not m...

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, meeting the blocking policy. Explicit-user ai-trash setup does not mitigate the independent postinstal...

The lifecycle behavior is concrete and package-controlled, not a scanner-only inference. It meets the firewall block rule for unconsented postinstall mutation of broad foreign AI-agent co...

The automatic postinstall mutation of foreign AI-agent skill directories is a concrete unconsented control-surface write. Source inspection found no remote payload fetch, but that does no...

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

This is concrete import-time staged payload execution, not normal telemetry: the downloaded bytes are executed without signature or hash verification. The absence of lifecycle hooks does...

Direct inspection confirms an npm postinstall mutates the foreign global Claude Code control surface and installs persistent hooks. The prior-setup guard limits reach but does not establi...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. No exfiltration is needed for this verdict.

The install hook concretely performs unconsented, broad foreign AI-agent control-surface writes. The absence of lifecycle network exfiltration does not remove this policy-defined blocking...

The package has a concrete install-time, unconsented mutation of broad foreign AI-agent control surfaces. Although no credential exfiltration or remote payload was found, this behavior me...

Concrete source shows unconsented postinstall mutation of a consuming project's package.json and Cursor rules. This meets the firewall block policy regardless of the absence of network ex...

Source inspection confirms concrete install-time OpenClaw control-surface changes and gateway exposure. The OpenClaw-presence guard does not establish user consent.