npm detections from LPM Firewall.

Direct source inspection confirms unconsented postinstall mutation of several global AI-agent control surfaces. This meets the install-control-surface block criterion regardless of benign...

Source inspection confirms unconsented postinstall mutation of several foreign global AI-agent control surfaces, which meets the blocking policy. The token-handling runtime path further i...

The concrete postinstall mutation of broad, foreign AI-agent control surfaces meets the block boundary. Hardened OpenCode defaults and lack of observed exfiltration do not remove the unco...

The lifecycle behavior is a concrete unconsented cross-vendor AI-agent control-surface mutation, meeting the blocking policy. No separate exfiltration chain is needed for this verdict.

The external logging endpoint receives account configuration during ordinary runtime initialization, including a JSON serialization of IMAP settings. No lifecycle hook is needed for this...

The package contains a concrete automatic credential-exfiltration path, not merely suspicious primitives or a user-invoked integration. The benign postinstall hook does not mitigate the r...

Source inspection confirms an import-reachable opaque payload with dynamic execution and host/network-capable primitives, not merely scanner labeling. Absence of lifecycle hooks does not...

The delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.

The package contains a concrete default-on exfiltration path to hardcoded external webhook receivers, not merely a generic request utility. No install hook is involved, but runtime use ex...

Source inspection confirms concrete staged remote execution and detached process launch, not merely suspicious primitives. Absence of lifecycle hooks does not mitigate import-time execution.

Source confirms automatic collection and remote transmission of raw command input, not merely network use for the advertised challenge service. The lack of install hooks limits installati...

The source confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. Safety checks and lack of network exfiltration do not remove that concrete persistence...

The package's postinstall concretely changes foreign global agent configuration, including Codex's generic default agent. Global-only guarding and non-overwrite behavior reduce collateral...

The package's proxy functionality is package-aligned, but its automatic global postinstall configures foreign Codex and Claude control surfaces, including the generic Codex default agent....

This is an unconsented npm postinstall mutation of broad, foreign AI-agent control surfaces, coupled with unverified remote native payload execution and persistence. It meets the firewall...

The install hook performs concrete, unconsented mutation of broad browser/AI-agent control surfaces, not merely an explicit user-command setup. The absence of observed credential exfiltra...

Source confirms automatic upload of environment-derived secrets to a hardcoded external endpoint during ordinary GitHub Actions operation. Lack of an install hook does not remove the cred...

Source inspection confirms a concrete default path that posts rich application records to embedded external webhook receivers. This is not required by installation and no local persistenc...

This is concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, plus execution of an unpinned globally fetched package. The lifecycle behavior meets the blo...

The package contains an enabled-by-default, hardcoded external telemetry destination and routes potentially sensitive application data to it. No install hook is needed for this concrete r...

The package contains no confirmed exfiltration chain, but its automatic lifecycle hook installs executable agent instructions across unrelated AI-agent platforms. That meets the firewall...