npm detections from LPM Firewall.

Concrete source establishes default-on collection and remote transmission of Claude transcript content after MCP activation. This is data exfiltration, not merely the package’s stated soc...

Direct source inspection confirms credential collection and exfiltration, not merely suspicious primitives. The lack of an install lifecycle hook limits the trigger to import/execution bu...

This is a concrete postinstall mutation of a foreign project’s broad AI-agent control surface. The benign design-system purpose and overwrite guard do not remove the unconsented lifecycle...

The branding/domain mismatch is implemented in executable auth, configuration, and memory-sync paths, creating a concrete credential and data-routing chain. The hidden forced updater comp...

The concrete postinstall overwrite of consumer `.claude/skills` meets the blocking policy for unconsented mutation of a foreign/broad AI-agent control surface. No separate exfiltration ch...

This is concrete browser page hijacking and remote payload delivery, not an inert helper or benign dependency behavior.

This is concrete credential exfiltration and remote-control behavior, not merely a dormant capability. The lack of install hooks reduces install-time risk but does not mitigate the explic...

Source directly establishes credential/environment exfiltration and remote arbitrary code execution on ordinary package import. The lack of an install hook does not mitigate this active r...

Source inspection confirms unconsented install-time mutation of consumer GitHub Actions configuration plus persistent external registration. The runtime bundle does not establish credenti...

This is a concrete import-time remote code execution chain controlled by an external endpoint, with no legitimate assertion-library purpose. The package should be blocked.

The package has a concrete unconsented postinstall path that installs hooks into existing Claude Code/Codex environments. Checksum validation limits tampering of the chosen release asset...

The package performs an unconsented install-time mutation of a consumer CI project and establishes persistent metadata exfiltration. The bundled frontend API traffic does not explain or m...

This is concrete unconsented install-time mutation of a consumer CI control surface combined with external reporting and persistence. The frontend bundle's normal Firebase/API traffic doe...

Source inspection confirms a concrete AI-agent permission-bypass configuration combined with remote shell bootstrap and persistent system provisioning. Although this is not npm lifecycle...

The package contains a concealed, immediately invoked remote code loader, not a package-aligned feature. Its lack of an internal trigger reduces automatic exposure but does not make the i...

Source directly implements credential harvesting and remote transmission of reusable Lark secrets. The user-facing telemetry and Digital Worker paths make this behavior concrete despite t...

This is a concrete concealed import-time arbitrary-code execution chain, not a package-aligned SDK feature. The detached process and inherited environment materially increase impact.

Source inspection confirms a concrete npm postinstall chain that deploys package-controlled AI-agent instructions across multiple unrelated agent homes. Under the firewall policy, this is...

Direct source inspection confirms an unconsented install-time exfiltration request. The empty entrypoint makes the telemetry behavior clearly malicious rather than package-aligned.

Source inspection confirms a concrete browser UI-hijacking and remotely controlled content-delivery chain. Although it has no install hook or local credential theft, the behavior is not c...

Source establishes a concrete surveillance-and-exfiltration chain paired with stealth persistence and proctoring evasion. The benign postinstall hook does not mitigate the malicious runti...