npm detections from LPM Firewall.

The install-time undeclared, unpinned npx execution is a concrete remote-code-execution loader. Other observed network, browser, and agent-hook behavior is package-aligned and does not mi...

The postinstall hook establishes persistent, package-authored commands in a user-wide agent configuration location. This meets the blocking policy for unconsented install-time AI-agent co...

This is a concrete, unconsented install-time mutation of a foreign AI-agent control surface, even though the behavior is documented and conditional. No network exfiltration or concealed p...

This is concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking policy. Collision checks reduce overwrite risk but do not remove the in...

Source inspection confirms a concrete postinstall persistence chain across multiple AI-agent hosts. The global-install default makes it unconsented rather than an explicit user-command se...

The lifecycle hook is unconditional and modifies global agent-discovered instructions outside the package, with forced overwrite. This meets the install-time AI-agent control-hijack block...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, not merely an explicit scaffold command. No separate credential theft or external data-exfiltration path...

This is concrete, unconsented postinstall mutation of a broad user-level AI-agent control surface; the forced overwrite makes it a block-level lifecycle hijack under policy.

The concrete postinstall chain performs unconsented configuration of a foreign/broad AI-agent control surface. The opt-out does not make the default install behavior consented.

The package performs the exact prohibited postinstall mutation of a foreign/user-level AI-agent control surface. The absence of observed exfiltration does not mitigate the control-hijack...

This is concrete, unconsented persistence through import-time dropping of an embedded executable, unrelated to the stated package purpose.

The concrete postinstall behavior satisfies the block policy regardless of scanner similarity labels. The lifecycle script writes outside the package and forcibly replaces foreign agent-c...

This is concrete hidden persistence behavior unrelated to the stated utility package and activates merely on import. Absence of an npm lifecycle hook does not mitigate the import-time dro...

The package implements a concrete automatic collection-and-exfiltration chain for administrator PII and deployment metadata unrelated to a user-invoked monitoring action. The lack of inst...

This is concrete stealthy persistence via an import-time payload drop, unrelated to the documented placeholder utilities. The absence of an install hook does not mitigate the malicious ru...

Source inspection confirms the lifecycle-driven global OpenCode configuration mutation; the scanner finding is substantiated. Although no exfiltration or remote code loading was found, th...

The lifecycle hook modifies global ~/.claude and ~/.codex control directories without a user command, meeting the blocking policy. The absence of a direct network call in the hook does no...

The package contains no observed exfiltration or remote code-loading chain, but its automatic postinstall installs and activates persistent global OpenCode control files. This meets the b...

The package description promises simple utilities, but its sole implementation is a concealed native payload dropper with Startup-folder persistence. The absence of lifecycle hooks does n...

The package has no observed exfiltration or remote payload chain, but its automatic postinstall globally installs and enables agent extensions. That meets the firewall block boundary for...

The source establishes an unconsented postinstall mutation of a foreign, broad AI-agent control surface. No additional exfiltration or remote execution is needed for this policy-defined m...