npm detections from LPM Firewall.

This is concrete, runtime-reachable credential/data exfiltration rather than a benign scanner primitive. The install hook itself is benign, but it does not mitigate the Android payload.

The source establishes a direct runtime path from IMAP configuration to a third-party logging URL; it is not required for the claimed storage functionality. No lifecycle hook is needed fo...

Source establishes a concrete credential-exfiltration chain triggered by an ordinary product command and persisted through its worker. The authentication precondition does not provide inf...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The subsequent plugin behavior compounds the risk through aut...

The package contains default, active external webhook endpoints and sends rich runtime records to them automatically. No install hook is present, but the runtime exfiltration behavior is...

This is a concrete unconsented postinstall mutation of foreign project-root AI-agent control files. Per policy, that lifecycle behavior warrants blocking even though no exfiltration was f...

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not mere...

This is concrete credential harvesting and remote exfiltration from a separate application's secret store, automatically coupled to an ostensibly local usage-start action. Authentication...

Source inspection confirms an unconsented postinstall mutation of ~/.claude.json and ~/.codex/config.toml. This meets the blocking AI-agent control-hijack boundary regardless of the scann...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote binary execution and broad host changes. It meets the firewall block policy ir...

The package contains a concrete, unconsented postinstall mutation of broad AI-agent control surfaces, including a persistent Codex lifecycle executable. This meets the install-control-sur...

This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.

This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.

Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.

This is more than a benign scanner primitive: source confirms remotely supplied executable hook replacement in a broad AI-agent control surface, plus interception and concealment of agent...

The unconditional postinstall download of an unsigned executable from an unrelated C2-named host is concrete malicious payload staging, despite no execution call in the inspected source.

This is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this ver...

Source confirms credential harvesting and remote transmission of app secrets and renewable personal tokens, initiated silently after an adjacent authorization workflow. This is concrete c...

Direct source inspection confirms concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. The opt-out does not establish user consent.

The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cl...

This is concrete default-on data exfiltration of rich application content to a hardcoded third-party endpoint, not merely ordinary local component behavior. No install-time execution was...