npm detections from LPM Firewall.

Source confirms a concrete, automatic install-time collection-and-upload chain rather than a scanner-only similarity match. The behavior is not required to install the library and uses a...

The install hook performs concrete network collection and remote reporting rather than a package-aligned build/setup task. Its hardcoded destination and forced demo event make the behavio...

Source confirms an install-time mutation chain targeting foreign AI-agent control surfaces. This meets the blocking policy regardless of the benign product purpose or guarded network code.

The package has no install-time hook, but its normal CLI path remotely selects and executes arbitrary npm packages with credentials and disabled Claude permission checks. That is a concre...

The package concretely performs unconsented postinstall mutation of OpenCode configuration and activates plugin paths supplied by a remotely downloaded artifact. This meets the firewall b...

The postinstall behavior concretely injects downloaded plugin code into OpenCode's configuration directory, while the package documentation describes a separate Capix configuration path....

This is an unconsented postinstall mutation of a foreign AI-agent control surface, coupled to remote payload installation. The absence of direct source-level credential theft does not rem...

Direct source inspection confirms a concrete postinstall chain that persists remote code and writes OpenCode plugin/provider configuration. The same-origin checksum does not establish ind...

The package performs a concrete, unconsented postinstall modification of OpenCode configuration and makes it load plugin paths supplied by a remotely downloaded runtime. The adjacent chec...

Source inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surf...

Source inspection confirms concrete automatic install-time metadata exfiltration to an unrelated external endpoint. This is malicious behavior, not a benign package setup action.

The distributed source contains reachable default webhook configuration and direct POST logic for application records. The absence of install hooks or host-level primitives does not mitig...

This is an unconsented install-time mutation of a foreign AI-agent control surface, coupled with an external payload bootstrap. Documentation makes the behavior less stealthy but does not...

The package's own source confirms a concrete automatic postinstall chain that stages remote code and rewrites a foreign OpenCode configuration. The checksum does not independently constra...

Source confirms a concrete credential-exfiltration chain, not merely scanner heuristics. The install-time workflow setup is secondary and does not mitigate the silent credential upload.

This meets the blocking policy because npm postinstall automatically mutates a foreign/broad AI-agent control surface. The package’s deferred hook-trust behavior reduces scope but does no...

Direct inspection confirms concrete hidden privileged access and outbound telemetry unrelated to user configuration. The lack of lifecycle hooks does not mitigate the runtime backdoor onc...

Source directly confirms automatic collection and forwarding of identifiable usage/profile data to a hard-coded external store. This is concrete unconsented telemetry exfiltration, not a...

Direct source inspection confirms a concrete, runtime-reachable credential disclosure path through a hidden global administrator. The absence of lifecycle hooks does not mitigate the back...

Bundled operational OAuth credentials create a concrete, implicit data-routing path from user files to a third-party account. The absence of install hooks does not mitigate this user-trig...

Direct source inspection confirms an undisclosed, foreign privileged account can retrieve credentials from every consumer deployment. This is a concrete credential-theft control path, not...