npm detections from LPM Firewall.

This is not date-parsing functionality: source inspection confirms obfuscated browser injection and unconsented data exfiltration activated by the exported API. The lack of lifecycle hook...

Source inspection confirms a concrete browser-side form-data exfiltration chain activated by the package's exported API. The absence of install hooks does not mitigate the malicious runti...

Source inspection confirms malicious runtime behavior behind the package’s exported date parser. Lack of lifecycle hooks limits installation-time exposure but does not mitigate the activa...

The normal entrypoint is inert, but the intentionally deceptive export activates import-time persistence of a handler designed to harvest sensitive host files. No lifecycle hook is requir...

This is concrete secret-harvesting and application-file mutation hidden behind a deceptive export, despite lacking an install hook or direct network call.

This is a concrete, persistent data-exfiltration path: full Codex trace synchronization is enabled by default and activates automatically when the package's own memory configuration suppl...

The concealed remote payload execution path is unrelated to the advertised SVG utility and creates concrete arbitrary code execution. Lack of lifecycle hooks limits automatic activation b...

Source inspection confirms a concrete, externally directed metadata-exfiltration channel rather than only scanner heuristics. It is runtime-gated but uses a hard-coded recipient unrelated...

Direct source inspection confirms automatic postinstall execution and outbound transmission of host-identifying data to an attacker-controlled callback endpoint.

Source confirms automatic silent telemetry to an unrelated remote host and concrete account/cloud metadata entering the logged channel. The benign install hook and loopback MCP server do...

The decoded, hidden install and immediate execution of an undeclared package are concrete malicious behavior, not polyfill functionality. Absence of a lifecycle hook does not mitigate imp...

The import-time hidden package installation and execution are concrete malicious behavior, not required for the declared polyfill functionality. The ESM entrypoint’s absence of this code...

The package contains a concrete, automatic credential-bearing data flow to an unrelated remote logging endpoint. This is malicious exfiltration, not required mail-provider traffic.

The CJS entrypoint implements a concealed remote payload loader and executor unrelated to SVG processing. No lifecycle hook is needed for this concrete runtime RCE capability to be malici...

The source confirms automatic postinstall installation into ~/.agents/skills/, not merely a user-invoked setup command. This meets the install-control-surface block boundary.

The package has concrete unconsented postinstall mutation of global Claude Code and Codex MCP configuration. This meets the install-control-surface block criterion regardless of the absen...

Source inspection confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, which meets the blocking policy. The lifecycle hook additionally performs remot...

The package contains no install-time behavior, but its normal runtime path automatically exfiltrates mail-account metadata through a third-party logging endpoint. The source directly esta...

The package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.

This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.

The lifecycle behavior is package-controlled and alters host Claude Code configuration/plugins during installation. Under the stated policy, that warrants blocking even though no credenti...