npm detections from LPM Firewall.

The source establishes intentional install-time execution and an external callback, not merely a static hint. Although no payload download or file modification was found, this is concrete...

This is concrete import-time malware execution, not calendar functionality or a scanner-only signal. The concealed native payload provides credential theft and exfiltration capabilities.

The import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.

The stated calendar/streak functionality does not require fetching and executing an opaque native binary. The behavior is concealed with character-code URL construction and runs automatic...

Source inspection confirms a concrete, automatic native payload drop-and-execute chain in the default import path. The absence of an npm lifecycle hook does not mitigate import-time execu...

The Windows native binary contains and invokes a concrete remote PowerShell execution chain during addon initialization. The benign package description and Linux SHA-256 implementation do...

Direct source inspection confirms immediate, concealed navigation behavior with a dynamically selected external host and no color-related implementation. This is concrete malicious runtim...

The package has no legitimate color-related behavior; its sole runtime payload performs covert parent-frame navigation and disruption. This is concrete malicious browser behavior, not a s...

The package contains a concrete concealed remote-code execution chain unrelated to its advertised scaffolding function. Absence of an install hook does not mitigate execution when its ser...

Source establishes unconsented API-key disclosure to a remote relay, not merely a risky primitive. The remote-command capability magnifies the impact.

源码确认了安装时对多个非本包拥有的 AI 工具用户配置的持久化修改，满足阻断条件。运行时还存在向默认远程 MCP 服务转发本地认证配置的具体链路。

This is concrete credential disclosure to a package-controlled relay, not merely an advertised AI-agent capability. Persistent arbitrary code loading and an opaque executable bytecode pay...

Direct source establishes unredacted API-key disclosure to a hard-coded third-party relay and remote task control. This is concrete credential-exfiltration behavior, not a scanner-only in...

The explicit daemon command is not install-time behavior, but it concretely discloses API credentials to a relay and exposes remote command execution. This exceeds a benign remote-agent c...

Source establishes credential transmission to a package-controlled relay, not merely an advertised remote-agent capability. The absence of install hooks does not mitigate this runtime exf...

This is concrete credential exfiltration to a package relay and a remotely directed command-execution path, not merely an advertised agent capability. No install hook is needed for the ha...

The credential transmission and remote-control chain are directly present in source, not inferred from scanner labels. Explicit user activation does not justify transmitting a BYOK key to...

This is concrete credential disclosure to a remote relay combined with remote host-control capability; it is not merely an inert agent toolset. No install lifecycle hook was found, but ru...

This is a concrete, concealed remote-code-execution loader, not an SVG utility feature. Lack of install hooks limits automatic activation but does not remove the malicious capability.

The lifecycle path concretely modifies broad Codex control surfaces and project hooks/configuration during installation. This meets the blocking policy even though no data-exfiltration ch...