npm detections from LPM Firewall.

Source establishes a concrete, automatic, unauthorized account mutation on the ordinary runtime path, with a remotely controllable target list. The benign preinstall version check does no...

Direct source inspection confirms an unconsented install-time data-exfiltration chain. The package has no apparent functional implementation beyond this behavior.

The install hook performs an unconsented, externally sourced mutation of a broad AI-agent control surface. This meets the install-control-surface block policy.

The package contains a concrete runtime credential-exfiltration path to an unrelated host. Absence of lifecycle hooks does not mitigate this user-runtime attack.

Source inspection confirms concrete install-time collection and local persistence rather than a scanner-only match. The absence of networking limits impact but does not remove the unconse...

Source inspection confirms a postinstall side effect that collects local metadata and writes it outside the package, aligned with the package's dependency-confusion PoC description. Absen...

Direct inspection confirms an automatic postinstall collector and file write; the benign runtime entrypoint does not mitigate that install-time behavior. No network transmission was found.

This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not...

Source inspection confirms the lifecycle payload and its local metadata collection/write behavior. The benign runtime entrypoint does not mitigate the install-time action.

Direct inspection confirms a reachable obfuscated npm-install-and-execute path in index.js. The absence of install hooks limits automatic activation but does not remove the concrete runti...

The advertised SVG-fetching purpose does not justify executing arbitrary code returned by an unrelated hard-coded host. This is a concrete remote-code-execution payload path despite lacki...

The package implements a remotely controlled execution and file-management agent against an unrelated hardcoded endpoint. Although it has no install hook and requires runtime activation,...

The package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.

Source directly confirms automatic collection of identifiable workspace/activity data and persistence to a fixed external Redis sink. This is a concrete, unconsented data-exfiltration cha...

The lifecycle behavior is concrete source code, not a scanner inference. It meets the firewall block policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Direct source inspection confirms automatic, undisclosed collection routed to an embedded third-party credential rather than a host-owned endpoint. This is concrete exfiltration behavior,...

This is concrete, automatic cross-host telemetry exfiltration to a hard-coded third-party store, not merely optional host-configured storage. The embedded credential makes the collection...

This is not a benign logger/middleware implementation: its entrypoint activates an opaque payload with credential-targeting, networking, and execution capabilities. The lack of an install...

The package performs no location-related function; its install hook exists to transmit a machine identifier through DNS. This is concrete install-time data exfiltration.

Source establishes a reachable runtime credential-exfiltration chain to an unrelated host. The benign workspace-only postinstall hook does not mitigate it.

The package contains concrete, unconditional telemetry-style exfiltration to a non-package-aligned host, with no consent gate or redaction. Its benign install hook and locally scoped MCP...