npm detections from LPM Firewall.

The package’s primary assets appear package-aligned, but its automatic postinstall performs broad, active AI-agent and MCP configuration changes in every consuming project. That concrete...

The install hook performs unconsented mutation of broad, foreign AI-agent skill control surfaces. This meets the blocking policy even though the inspected installer shows no separate exfi...

Direct source inspection confirms unconsented postinstall mutation of a broad AI-agent control surface and a concrete token-bearing outbound flow. These exceed a same-vendor setup shim an...

Source directly establishes default remote telemetry and unredacted credential-bearing command arguments. This is concrete credential exfiltration, not merely a suspicious primitive.

This is concrete default credential exfiltration, not merely legitimate command telemetry: secrets accepted as CLI options are forwarded without filtering to an external analytics host. N...

The package contains a concrete, reachable default path that transmits environment-derived secret values to an external package-controlled host. Absence of an npm install hook does not mi...

Source inspection confirms unconsented postinstall mutation of a consuming project's broad AI-agent control surface plus Git-hook persistence. This meets the firewall block boundary regar...

The source establishes a concrete credential-exfiltration path in a normal documented login flow, not merely a scanner signature. Lack of lifecycle hooks does not mitigate this runtime ac...

The lifecycle hook performs concrete, unconsented replacement of broad foreign AI-agent skill locations. This meets the install-control-surface blocking boundary despite no observed insta...

Source inspection confirms the critical finding: an automatic npm lifecycle hook replaces Codex and Claude Code skill directories. Disclosure in documentation does not make this opt-in ag...

The confirmed postinstall mutation of foreign/broad AI-agent skill directories meets the blocking policy, even though no separate payload exfiltration was found.

Source confirms a default-enabled hard-coded external reporting path for locally collected Claude and development-work data. The package's own plugin setup is not independently blocking,...

Source inspection confirms install-time mutation of a consuming project’s Claude control files. This meets the firewall block boundary despite otherwise benign template content.

The package performs unconsented postinstall mutation of foreign, broad AI-agent control surfaces. This meets the blocking policy despite no observed data exfiltration or remote payload e...

The runtime MCP service is package-aligned, but its postinstall hook silently patches a third-party OAuth consent control surface. That install-time mutation is concrete and can extend be...

The package performs a concrete, automatic postinstall mutation of the consuming project's broad Claude Code extension and instruction directories. This meets the blocking policy even tho...

Source confirms an unconsented postinstall mutation of broad third-party AI IDE configuration and instruction surfaces. This meets the install-control-surface blocking policy despite no o...

Source confirms the scanner finding: lifecycle code automatically writes host MCP configuration and enables a host Git hook. This meets the firewall block boundary regardless of the absen...

Direct source inspection confirms unconsented postinstall mutation of a consumer project’s broad AI-agent control surface and persistent Git configuration. The overwrite guard does not mi...

This meets the block boundary: an npm postinstall mutates a foreign host project’s AI/MCP configuration and activates a Git hook. Lack of a confirmed network exfiltration path does not re...

The lifecycle script performs unconsented postinstall mutation of the foreign, user-wide Claude Code hook surface. Its conditional binary lookup does not make the automatic persistent hoo...