npm detections from LPM Firewall.

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, which meets the blocking policy. No network exfiltration was found in the inspected JavaSc...

The package embeds active, non-placeholder external webhook credentials and enables them by default for runtime business logging, including user-supplied scan codes. This is a concrete un...

Source directly confirms unconsented postinstall mutation of broad third-party AI-agent configurations, coupled with remote executable delivery and persistence. This meets the blocking po...

The confirmed postinstall deletion of foreign Codex and Claude runtime dependencies meets the install-time AI-agent control-surface mutation block boundary. Scanner claims about runtime e...

The behavior is transparent and no exfiltration was found, but the package automatically persists execution hooks in Claude Code during installation. This meets the block policy for uncon...

The package performs an unconsented postinstall mutation of the user's Claude Code settings, a foreign AI-agent control surface. Its stated keyboard-notification purpose and lack of netwo...

The source confirms default-enabled transmission of rich runtime records to hardcoded external receivers, not merely a generic network capability. This is concrete data exfiltration despi...

This is concrete unconsented install-time modification of an external AI-agent control surface, compounded by default collection and remote upload of sensitive development and AI-session...

Direct source inspection confirms an unconsented postinstall mutation of six foreign AI-agent skill surfaces. This meets the firewall block threshold regardless of the CLI’s stated music...

The lifecycle script directly persists package-controlled skills and an MCP launcher in third-party Claude user configuration without an explicit user command. This meets the install-time...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. The hardening of some OpenCode rules does not remove the auto...

The hardcoded remote credential store is reached by the normal pairing path and persists sensitive WhatsApp authentication state without user-provided database configuration. This is conc...

Source confirms an unconsented postinstall write to foreign project-root AI-agent control files. This meets the install-control-surface publish-block boundary even though no exfiltration...

The package implements an unconsented install-time persistent marker specifically intended to invisibly alter its MCP output. Obfuscation of the distributed runtime further prevents norma...

The package has a concrete unconsented postinstall chain that persistently mutates broad, cross-vendor AI-agent control surfaces. This meets the install-control-surface block boundary des...

This is concrete, undisclosed import-time remote payload execution, not telemetry aligned with a small utility package. The absence of lifecycle scripts does not mitigate the reachable ma...

Hard-coded, enabled-by-default webhook telemetry sends host application records to an undisclosed endpoint. The absence of lifecycle hooks does not mitigate the runtime exfiltration path.

The import-time remote binary loader and detached execution are concrete malicious behavior, not ordinary telemetry. No lifecycle hook is needed because the package entrypoint triggers th...

The postinstall hook performs unconsented mutation of foreign/broad AI-agent skill surfaces. That concrete lifecycle behavior meets the blocking policy even though no credential exfiltrat...

This is concrete import-time remote code execution with obfuscated endpoints and no user-directed feature activation. The absence of npm lifecycle scripts does not mitigate runtime compro...

Source inspection confirms a concrete import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate malicious runtime behavior.