npm detections from LPM Firewall.

The runtime entrypoint loads a concealed payload with command-execution and outbound-request primitives that are not package-aligned. Lack of an install hook does not mitigate import-time...

Direct source inspection confirms an install-time chain for configuration/secret exfiltration and attempted SSH persistence. This is concrete malicious behavior, not a library feature or...

Source directly establishes a runtime path from account IMAP credentials to a silent third-party logging endpoint. No lifecycle hook is needed for the malicious behavior to activate in th...

The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exporte...

Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.

Direct source inspection confirms runtime cookie exfiltration behind a React icon component. The lack of lifecycle scripts does not mitigate the rendered-component attack surface.

Direct source inspection confirms concrete browser cookie exfiltration on component render. The absence of lifecycle hooks limits the trigger but does not mitigate the malicious runtime b...

Direct source inspection confirms runtime cookie exfiltration to hard-coded external endpoints. The absence of lifecycle hooks does not mitigate this malicious browser-side behavior.

The concrete postinstall mutation of a consuming project's root CLAUDE.md meets the foreign/broad AI-agent control-surface blocking policy. No exfiltration was found, but it is not needed...

The package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party...

The undisclosed, hardcoded public database destination and credentials create a concrete default data-exfiltration path in generated projects. The absence of a lifecycle hook does not mit...

The package contains concrete, automatic browser-context exfiltration to a hard-coded third-party endpoint. The postinstall patch itself appears benign but does not mitigate the import-ti...

The source confirms an unconsented install-time write to consumer project agent-control files. This meets the policy's publish-block condition despite the absence of exfiltration or runti...

The source contains a concrete, user-triggered remote code execution chain with no integrity or trust validation. Lack of install hooks limits automatic activation but does not make the e...

The package is a concrete remote code execution loader, not a normal API client: its only exported behavior retrieves and executes server-provided code. The documented API does not match...

The package contains a concrete install-time takeover of an existing Hermes control surface, rather than merely an explicit user-invoked setup flow. That meets the blocking policy even th...

Source establishes a concrete, remotely controlled and unconsented account-action chain. The lifecycle hook is benign, but it does not mitigate the runtime behavior.

Source inspection confirms concrete postinstall mutation of consumer AI-agent configuration across several platforms. Under the stated policy, this requires blocking even though no direct...

The hidden import-time payload and concealed host/process capability are concrete malicious behavior, not package-aligned functionality. Absence of an install hook does not mitigate execu...

The source establishes a concrete import-time hidden payload with process execution and network capability; no legitimate package function accounts for it. Absence of lifecycle hooks limi...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. The absence of observed exfiltration does not mitigate th...