npm detections from LPM Firewall.

Source confirms unconsented postinstall mutation of a consumer AI-agent control surface, not merely an explicit user setup command. This meets the blocking policy despite idempotence and...

The shared hardcoded database is not needed for local bot operation yet receives WhatsApp authentication material. This is concrete credential exfiltration/persistence, not merely a noisy...

Source confirms a hard-coded remote control plane can deliver executable definitions and receive environment secrets during normal CI CLI execution. This is concrete malicious-capable beh...

Direct inspection confirms the package performs the policy-defined blocking behavior: npm postinstall mutates multiple foreign AI-client control surfaces without an explicit user setup co...

Direct inspection confirms a reachable prompt-based control override in the bundled runtime. Absence of an install hook or confirmed credential exfiltration does not remove this runtime a...

The postinstall hook concretely performs unconsented mutation of a consumer project's Claude skills, including destructive replacement. This meets the install-time foreign AI-agent contro...

The lifecycle hook concretely mutates multiple foreign agent skill directories without an explicit setup command or install-time consent. This meets the install-control-surface block boun...

The documented behavior is intentionally implemented, but it meets the block policy: unconsented postinstall mutation of foreign AI-agent control files and consumer build scripts. No exfi...

This is a concrete unconsented postinstall mutation of foreign, repository-level AI-agent control files. The absence of exfiltration does not remove the install-time control-surface risk.

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, which meets the blocking policy. Other observed network and hook features are not needed for the verdict.

Source inspection confirms a concrete runtime exfiltration path, including potential IMAP credentials, to an external logging endpoint. No lifecycle hook is involved, but the credential-b...

This is concrete malicious behavior, not a noisy binary heuristic: a calendar utility imports and executes a bundled backdoor with exfiltration and persistence capabilities. No lifecycle...

The postinstall hook performs external runtime provisioning and code installation, rather than merely configuring package-owned files. That is a concrete install-hook remote-payload execu...

The lifecycle chain is source-confirmed and unguarded for npm installs; its setup does not limit configuration writes to a package-owned surface. This meets the blocking policy independen...

The confirmed postinstall chain mutates a broad foreign AI-agent control surface and establishes persistence. This meets the block policy despite package-aligned loopback networking and r...

This is a concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, coupled with remote binary execution. It meets the blocking policy regardless of package...

Source confirms unconditional chat-content transmission under a vendor account key, contrary to the documented local/opt-in sync behavior. The harmless preinstall hook does not mitigate t...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, accompanied by persistence. Localhost binding does not remove the control-hijack risk becaus...

Source inspection confirms a concrete postinstall write into Codex's global skills directory. That behavior meets the firewall block boundary regardless of otherwise package-aligned API a...

The lifecycle behavior meets the block boundary: npm postinstall mutates multiple foreign global AI-agent control surfaces without an explicit user setup command. Lack of download/exfiltr...

The concrete install-time writes to multiple foreign global AI-agent control surfaces meet the blocking policy. Hardened OpenCode permission defaults do not remove the unconsented lifecyc...