npm detections from LPM Firewall.

This is concrete unconsented postinstall mutation of foreign/broad AI-agent configuration, meeting the blocking policy even though no direct credential exfiltration was observed.

Source inspection confirms the lifecycle hook performs unconsented, broad AI-agent configuration and hook mutations. This meets the install-control-surface block boundary even though no s...

Source inspection confirms unconsented postinstall mutation of a broad foreign AI-agent control surface. This meets the install-control-surface blocking rule.

This is a concrete unconsented postinstall AI-agent control-surface mutation, meeting the block boundary. Lack of a confirmed exfiltration endpoint does not mitigate the persistent hook/c...

The package’s automatic install-time modification of global/project Codex configuration and lifecycle hooks meets the blocking policy for foreign broad AI-agent control-surface mutation....

The lifecycle code implements concrete, default-on mutation of foreign/broad Codex configuration and extensions. Guardrails and opt-outs do not make the install-time action consented.

Direct inspection confirms the policy-defined block condition: postinstall performs unconsented mutation of foreign/broad Codex control surfaces. Guardrails and backups do not remove the...

Source inspection confirms the lifecycle hook performs broad Codex and project-control-surface mutations by default. This meets the firewall block boundary for unconsented postinstall AI-...

Direct source inspection confirms unconsented postinstall writes to global Codex and agent configuration, including auth-related files and MCP setup. This meets the firewall block policy...

Source inspection confirms a concrete credential-exfiltration and remote-command-control chain, not merely a bytecode or network heuristic. The explicit runtime trigger does not remove th...

Source inspection confirms a concrete, unconsented postinstall mutation of broad AI-agent control files, sourced from a remote mutable archive. This meets the blocking policy.

The source establishes an unconditional import-time remote-code-execution chain. It has no package-aligned functional safeguard or integrity validation.

The lifecycle hook concretely mutates a foreign AI-agent implementation during installation. Its narrow, version-checked patch does not remove the unconsented cross-package control-surfac...

The lifecycle hook establishes and enables agent extensions across unrelated tools at install time, including unconditional Claude mutation and Codex config changes. This meets the instal...

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The absence of network exfiltration does not remove the install-time control-surface abuse.

Source inspection confirms unconsented install-time persistence across multiple third-party AI-agent configurations, meeting the block policy despite no confirmed install-time exfiltration.

The source confirms unconsented postinstall mutation of the consuming project's shared AI-agent instruction file. Under the firewall policy this concrete control-surface write requires bl...

The concealed remote payload loader is concrete arbitrary code execution, not required for the documented SVG functionality. Absence of install hooks limits automatic activation but does...

This is concrete, unconsented install-time mutation of broad foreign AI-agent control surfaces, meeting the blocking policy. The absence of install-time networking does not mitigate the p...

The automatic, concealed runtime installation and execution of an unrelated dependency is concrete malicious behavior, not required for a Rollup polyfill plugin. No lifecycle hook is need...

Source confirms a default runtime path that forwards rich application logs to package-embedded external receivers. The absence of install hooks reduces installation risk but does not remo...