npm detections from LPM Firewall.

Automatic installation-time rewriting disables a third-party agent's sandboxing, then the launcher activates and persists the unsafe permission default. This is a concrete AI-agent contro...

The package has an unconsented postinstall path that mutates a foreign, broad AI-agent control surface and installs a future execution command. This meets the install-control-surface bloc...

The automatic remote-script download and evaluation path is a concrete remote code execution capability. The obfuscated bundled browser payload reinforces that this is not a transparent c...

This is an unconsented postinstall mutation of a broad AI-agent control surface that enables external collection of Claude session content. The opt-out environment variable does not chang...

Automatic execution of an obfuscated payload that collects and transmits IP and location data through an authenticated account is concrete data exfiltration. The absence of an install hoo...

The package contains an active path that defaults a user-facing feature to package-embedded external webhooks and transmits its log records there. The absence of an install hook does not...

The automatic lifecycle chain mutates a broad AI-agent control surface and downloads current external installer code through npx. This meets the install-hook abuse blocking boundary.

The postinstall hook automatically writes package-controlled content into user-level Claude and Codex agent directories. This meets the install-control-surface blocking policy despite the...

The automatic lifecycle hook modifies consumer configuration and writes agent-control content without an explicit setup command. This meets the policy for blocking unconsented postinstall...

The automatic lifecycle mutation of a foreign, user-wide AI-agent control surface meets the blocking policy. The script is conditional on executables being present, but no consent gate li...

The automatic lifecycle hook mutates global Codex agent configuration and registers a remote MCP service. This meets the blocking policy for unconsented postinstall control-surface mutation.

The automatic post-install chain mutates foreign AI-agent configuration and installs executable lifecycle hooks without interactive consent. This is concrete install-hook abuse under the...

The automatic post-installation of external AI authentication tooling into the global environment is a concrete unconsented lifecycle mutation. The environment gates limit scope but do no...

The automatic lifecycle hook writes an unrestricted agent configuration outside the package into a global AI-agent configuration directory. Existing-file preservation and an opt-out do no...

The automatic global lifecycle chain changes shell startup behavior and AI-client routing. This meets the blocking policy for unconsented post-install mutation of a broad AI-agent control...

The automatic post-install path defaults to mutating Cline configuration and global agent guidance when the user provides no affirmative consent. That concrete lifecycle behavior meets th...

The automatic lifecycle hook performs an enabled Cline MCP and behavior-guidance installation when the prompt receives no affirmative response. This meets the install-control-surface bloc...

The postinstall hook deletes consumer-project data without a package-aligned need, then executes a downloaded binary. This is concrete destructive install-time behavior, not ordinary wrap...

This is concrete, selective website disruption executed on import, not a component-library feature. The remote audio and input blocking establish active protestware behavior.

OpenSSF Malicious Packages via OSV confirms llm-nebula@1.0.0 as malicious (MAL-2026-17230): Malicious code in llm-nebula (npm)

The undocumented, import-time hidden launch and directory watch establish a concrete covert execution chain. The lack of a network sink does not remove the local execution and staging risk.