npm detections from LPM Firewall.

The package performs confirmed, unprompted recursive user-data deletion at install time. Its LAN sync and Electron-launch behavior do not establish exfiltration, but do not mitigate the d...

Source inspection confirms an unconsented install-time destructive action against the package's stored credential data. No exfiltration was found, but the automatic vault deletion warrant...

The lifecycle hook creates and configures a consumer project's Claude Code control surface automatically. Under the install-control-surface policy, this concrete behavior requires blockin...

The package's sole runtime behavior is unvalidated remote-code retrieval and eval at import time. This is a concrete remote code execution chain, not merely a suspicious primitive.

The package performs an unconsented postinstall mutation of a foreign AI-agent control surface. This meets the firewall block boundary even though the separately provided hook workflow is...

This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, coupled with remote payload download and execution. The restrictive guards do not provide user con...

The package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted pa...

Source establishes an active runtime path from account configuration to an external endpoint, including possible credentials. The benign workspace-only postinstall hook does not mitigate...

This is a concrete credential-exfiltration path in shipped runtime code, not merely a suspicious primitive. The install hook itself is benign, but does not mitigate the runtime behavior.

The package contains a concrete, runtime credential-exfiltration path to an unrelated logging endpoint. It is not required for mail synchronization and has no user-consent gate.

Source directly establishes a runtime credential-exfiltration path to rmf39.aaz.lt. The lack of install hooks does not mitigate this user-runtime attack.

The package is a minimal carrier for an unauditable remote dependency that automatically executes installation code. Static exports are benign but do not mitigate the install-time executi...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup command. The forced rules redirect agent behavior to a downlo...

This is a concrete remote-code-execution backdoor pattern, not merely normal CLI process launching. Lack of an install hook limits automatic exposure but does not remove the dangerous rea...

Source inspection confirms the critical behavior directly: postinstall overwrites global Claude/Codex skill entries rather than requiring an explicit setup command. This meets the firewal...

This is concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The documented manual workflow and opt-out do not make the defa...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. No network or credential-exfiltration chain was found, but i...

This is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall l...

Direct inspection confirms a postinstall hook that mutates foreign AI-agent control surfaces, matching the publish-block boundary. Obfuscation and unrelated dependency rewriting increase...

Direct source inspection confirms unconsented postinstall mutation of multiple foreign AI-agent instruction files, with instructions designed to redirect and constrain agent behavior. Thi...

Source inspection confirms a postinstall hook writes a persistent global Claude Code instruction file. The guards and opt-out do not establish user consent for this broad control-surface...