npm detections from LPM Firewall.

Source confirms an undisclosed, automatic and detached upload path for local AI conversation content. No install-time hook is present, but runtime data exfiltration is concrete.

Source directly implements unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not a package-aligned feature.

This is a concrete, undisclosed import-time remote code execution chain unrelated to a UUID package. The absence of lifecycle hooks does not mitigate the automatic runtime trigger.

Direct source inspection confirms raw credential exfiltration to a package-author-controlled endpoint. The lack of an install hook limits automatic reachability but does not remove the co...

Source directly establishes an automatic import-time remote payload download and execution chain. This is concrete malicious behavior, independent of scanner labels.

Direct source inspection confirms a concrete credential-exfiltration path in the Android runtime. The lifecycle script itself is not the attack vector.

The source implements unconsented transmission of mail-account configuration, including potential IMAP credentials, to a third-party logging host. This is concrete credential exfiltration...

Source confirms concrete remote exfiltration of clipboard data and screenshots, activated by the package’s advertised executable. Absence of an install hook does not remove the malicious...

The package contains a concrete automatic data-exfiltration path to an unrelated host, including a path that can send IMAP credentials. This outweighs the otherwise mail-aligned network b...

The documented package is calendar/streak math, but its primary entry contains a concealed import-time downloader, detached executable launch, and persistence mechanism. The environment g...

The package explicitly transmits a consumer credential to a hard-coded developer endpoint during normal use. Lack of an install hook does not mitigate this concrete credential-exfiltratio...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. Lack of observed lifecycle exfiltration does not remove the...

Direct source inspection confirms unconsented postinstall mutation of a foreign AI-agent control surface, plus persistence and interception setup. This meets the blocking policy despite s...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, not merely a user-invoked integration. The source establishes transcript access through that ins...

This is a concrete unconsented npm postinstall mutation of broad, foreign AI-agent control surfaces. Under the stated policy, that requires a block regardless of the package-aligned servi...

The install hook concretely writes package-controlled AI-agent instructions into foreign global agent directories. This meets the blocking policy for unconsented postinstall mutation of a...

Direct inspection confirms the lifecycle script writes package-controlled instructions into existing ~/.claude and ~/.codex installations. This meets the blocking policy regardless of the...

Direct inspection confirms the postinstall drop into ~/.claude and ~/.codex, not merely scanner inference. This meets the firewall block boundary for unconsented postinstall mutation of b...

The lifecycle hook performs an unconsented install-time mutation of existing Claude Code/Codex control surfaces. This meets the firewall blocking boundary regardless of the package’s stat...

Source inspection confirms concrete postinstall database mutation, not merely static network indicators. The limited noninteractive guard does not prevent execution when project environme...

Source directly confirms unconsented install-time collection and external transmission of local system data. This is concrete malicious exfiltration, not a benign package feature.