npm detections from LPM Firewall.

The package establishes a persistent system service during postinstall and hides the implementation with heavy obfuscation. This is concrete malicious install-time persistence.

The declared entrypoint performs concrete, automatic remote payload execution at import time. No install hook is needed for this to be a malicious RCE chain.

This is concrete import-time remote code execution, not aligned with the advertised highlighted-text module. Lack of lifecycle scripts does not mitigate execution on normal use.

This is a concrete import-time remote payload execution chain unrelated to the advertised SDK. The absence of install hooks does not mitigate execution when an application imports the pac...

The package contains concrete, import-time remote binary execution concealed behind an unrelated fonts API. This is a direct malware execution chain, not normal telemetry.

The package’s public import path contains a concealed, remote payload execution chain unrelated to its stated adapter API. This is concrete malware behavior despite the absence of npm lif...

Direct source inspection confirms a concealed postinstall remote payload loader and arbitrary dynamic execution. This is concrete malicious install-time behavior.

This is a concrete install-time remote-code-execution chain, not required package functionality. Detached execution and obfuscation make the behavior covert.

Concrete runtime conversation exfiltration contradicts the documented opt-in cloud-sync behavior. The preinstall hook is benign, but does not mitigate the runtime data-transfer chain.

The global-install guard limits scope but does not obtain user consent or prevent modification of the default Codex agent and shared host configuration. This meets the install-time foreig...

This is a concrete, unconsented postinstall mutation of foreign/broad AI-agent control surfaces. Localhost-only networking does not mitigate the install-time agent configuration changes.

This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, coupled with an unverified remote native-payload chain and persistence. The guards and careful...

Although the installed content is package-aligned and no exfiltration or remote execution was found, the npm postinstall automatically installs behavior-bearing Claude Code configuration...

This is concrete unconsented postinstall mutation of broad AI-agent control surfaces coupled with persistence and remote egress. The later consent gate does not undo or precede the instal...

The lifecycle hook performs default-approved writes to a foreign project’s Claude Code files. The absence of exfiltration does not remove the policy-defined install-time agent-control hij...

The package's documented export is benign, but its import-time side effect is a concrete remote binary loader and executor. No lifecycle hook is needed because normal use activates the pa...

The lifecycle hook automatically installs package-controlled agent instructions into multiple global AI-client control surfaces. That concrete install-time mutation meets the blocking pol...

Source establishes a concrete, automatic download-and-execute chain on package import, unrelated to the advertised wrapper API. No lifecycle hook is needed for the impact.

The package concretely performs unconsented postinstall mutation of consumer AGENTS.md/CLAUDE.md and build scripts. This meets the blocking policy for foreign/broad AI-agent control-surfa...

Source inspection confirms a concrete import-time downloader-and-executor chain, independent of lifecycle scripts. The benign-looking exported bridge does not prevent the side-effecting _...

Concrete import-time download-and-execute behavior is present in _adapter.js, independent of scanner labels. The lack of an npm lifecycle hook does not mitigate execution when consumers i...