npm detections from LPM Firewall.

Source inspection confirms a concealed redirect to a Microsoft-lookalike domain, not a benign package function. Absence of install hooks does not mitigate the browser phishing payload.

This is a concrete, persistent telemetry-exfiltration chain to an unencrypted hard-coded IP endpoint. Explicit installation and metadata-only aggregation reduce ambiguity, but do not elim...

Although installation itself has no lifecycle execution, the package intentionally ships a browser-executed deceptive redirect payload with a concealed destination. The lack of a legitima...

The package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.

Source inspection shows a deceptive browser flow with obfuscated external redirect and query forwarding; it is unrelated to a plausible npm package function. Absence of install hooks does...

The only executable package entrypoint contains a concrete obfuscated redirect to a likely phishing domain, not a legitimate package function. Absence of install hooks does not remove the...

Direct source inspection confirms an externally controlled payload is dynamically executed. The lack of install hooks does not mitigate runtime remote code execution.

Although it has no npm lifecycle hook, the declared entrypoint is an obfuscated fake-verification redirector with no package-aligned purpose. The concealed destination and query forwardin...

The package’s public JavaScript math functions are a facade for an import-time native backdoor. The pinned hash verifies the malicious binary rather than mitigating it.

This is concrete remote code execution and command-output exfiltration functionality, concealed by a large decoded eval payload. The lack of lifecycle hooks limits automatic activation bu...

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limi...

The package routes WhatsApp authentication material to a hardcoded remote MongoDB default and forwards message-derived data to a fixed Telegram recipient. These are concrete, unconsented...

Source inspection confirms automatic postinstall-driven global mutation of ~/.claude. That meets the firewall block boundary even though no exfiltration or remote payload execution was fo...

The install lifecycle performs unconsented global AI-agent control-surface mutation. This meets the blocking policy even though the lifecycle script itself does not make network requests.

The package has a concrete, automatic postinstall path that creates consumer-project AI instruction files. Non-overwrite safeguards do not remove the unconsented control-surface mutation.

The hardcoded Telegram destination receives WhatsApp-derived personal data during normal bot operation, establishing a concrete exfiltration path. The Termux preinstall system-package mut...

This is concrete, unconsented postinstall mutation of a foreign, broad AI-agent control surface, not merely an explicit CLI setup flow. The lifecycle persistence meets the block policy de...

This is a concrete install-time mutation of generic, foreign AI-agent instruction files, which meets the blocking policy regardless of the absence of data exfiltration.

The lifecycle hook performs concrete, automatic writes outside the package, including broad AI-agent instruction files and consumer build commands. That meets the blocking policy even tho...

The lifecycle hook performs unconsented postinstall writes to foreign/broad AI-agent skill directories, meeting the blocking policy. The absence of visible exfiltration does not mitigate...

This is a concrete unconsented postinstall mutation of the broad Codex skill control surface. The absence of immediate exfiltration does not remove the persistence and agent-control risk.