npm detections from LPM Firewall.

Direct source inspection confirms an automatic install-time secret-harvesting and exfiltration chain. This is concrete malicious behavior, not a package-aligned network use.

Direct source inspection confirms an automatic install-time credential and wallet-file exfiltration chain. This is concrete malicious behavior, not a noisy static signal.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, coupled to baked remote egress and transcript collection. Consent governs capture only after the...

Direct source inspection confirms the lifecycle hook performs broad AI-agent configuration and instruction changes automatically. This meets the blocking policy regardless of the absence...

Source confirms a covert, persistent-on-use path that uploads foreign AI-agent conversation data to a remote backend. The absence of install hooks does not mitigate this concrete unprompt...

Direct source inspection confirms a concrete broad AI-agent control-surface mutation chain triggered automatically by npm postinstall. This meets the blocking policy regardless of the pac...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, with a baked remote collector and persistence. Consent is requested only after setup, so it does no...

The math API is a thin JavaScript façade, while import-time execution launches a bundled backdoor unrelated to its stated purpose. This is concrete malicious behavior, not a benign native...

Source directly confirms install-time remote native payload delivery and deliberate security-warning bypass. Digest checking does not negate the package-authored payload or the evasion be...

This is concrete, unconsented postinstall mutation of foreign and broad AI-agent configuration/control surfaces. The absence of exfiltration does not mitigate the automatic cross-agent pe...

The package has a concrete install-time security-bypass chain for a remote native payload, not merely noisy static primitives. Hash pinning does not mitigate the intentional evasion of pl...

Source inspection confirms an unconsented postinstall mutation of consumer AI-agent instruction files and build controls. Although no exfiltration or remote execution was found, this meet...

Direct source inspection confirms a documented consent gate that is bypassed for headless execution while telemetry remains enabled and sends identifiable Salesforce metadata. This is con...

The source establishes an import-time, obfuscated remote payload chain with direct eval and detached process execution. Absence of npm lifecycle hooks does not mitigate execution when the...

Direct source inspection confirms deliberate consumer-build tampering and a delayed remote-triggered blocking UI. The lack of npm lifecycle hooks limits install-time impact but does not r...

The install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.

The lifecycle hook is concrete, unconditional for ~/.agents/skills, and modifies a broad foreign AI-agent discovery path. Under the install-control-surface policy, this requires a block r...

Direct source inspection confirms credential disclosure to a third-party endpoint, not merely a scanner heuristic. The lifecycle hook is benign, but it does not mitigate the credential-ex...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. The opt-out environment variable and lack of postinstall networking do not remove the inst...

The hidden, remote-controlled account modification is concrete runtime behavior, not a scanner-only similarity signal. The install hook itself is benign, but normal package use activates...

The package has a concrete obfuscated, detached preinstall payload loader rather than package-aligned functionality. Its remote code execution path is directly established from source.