npm detections from LPM Firewall.

This is concrete, unconsented postinstall mutation of a foreign and broad AI-agent control surface, followed by persistent execution over future Claude Code events. That meets the blockin...

Source inspection confirms the concrete install-time Claude Code control-surface mutation required for blocking. The scanner’s credential-exfiltration label is not independently confirmed...

This is a concrete, conditional postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit user-invoked installer. The hooks cover sensitive agent events and...

Source inspection confirms the lifecycle script persistently wires package-controlled code into Claude Code's global configuration and hooks. This meets the firewall block policy for post...

The lifecycle path establishes persistent, user-wide Claude Code execution and instruction control without an explicit setup command. This meets the blocking policy regardless of otherwis...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent configuration and lifecycle controls. It meets the firewall block boundary despite no observed exfiltration.

This is concrete unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. The unrelated scanner exfiltration claims were not confirmed as a...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. The interactive cloud setup does not mitigate that install-time behavior.

Source directly establishes a broad Claude Code hook/MCP persistence chain from npm postinstall. This meets the install-control-surface block boundary even without confirmed exfiltration.

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The source directly establishes persistence and execution triggers rather than merely exposing a...

The install-time source contains a concrete credential-exfiltration chain; the advertised arithmetic functionality does not justify it.

Concrete silent transmission of account metadata to an unrelated logging endpoint establishes unconsented data exfiltration. The install hook itself is benign, but does not mitigate the r...

This package has concrete import-time payload staging and execution behavior, not array utility functionality. Obfuscation and hidden execution establish a malicious remote-code-execution...

The package has no declared functionality beyond an automatic preinstall script that covertly sends local host metadata over DNS. This is concrete, unconsented install-time data exfiltrat...

Concrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.

Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain trigger...

The concealed outbound request, silent failure handling, and complete mismatch with the package name establish a concrete data-exfiltration capability. There is no install hook, but runti...

The source implements a concrete credential-routing configuration change, not a normal Anthropic setup. The absent manifest entrypoint limits activation but does not make the source behav...

Source establishes an automatic credential-bearing telemetry path to an unrelated host. The benign install hook and explicit MCP utility do not mitigate this runtime exfiltration.

Source directly establishes automatic third-party transmission of account configuration that can include passwords. The benign workspace-only postinstall does not mitigate the runtime exf...

This is concrete concealed malware executed at import time, unrelated to calendar/streak functionality. Absence of npm lifecycle hooks does not mitigate the runtime dropper.