npm detections from LPM Firewall.

Source code establishes an active, silent credential/configuration exfiltration path to an unrelated remote host. Package-local lifecycle wiring and the opt-in MCP bridge do not mitigate...

The source contains a concrete, automatically executed browser attack chain with data exfiltration and destructive account control actions. The lack of install hooks does not mitigate run...

Source inspection confirms a remote-controlled command-execution path, not merely obfuscation or a scanner heuristic. The absence of an install hook does not mitigate the runtime MCP back...

The package contains concrete, unconsented install-time shell execution that probes an internal-looking service and exfiltrates retrieved content to an external OAST domain. This is malic...

This is a concrete, default-on, automatic data-collection and external-agent execution chain, not a scanner-only primitive. The benign preinstall guard does not mitigate the runtime exfil...

This is concrete import-time credential and host-information exfiltration with no package-aligned functionality. The absence of lifecycle hooks does not mitigate execution when consumers...

Source inspection confirms a concrete import-time credential and host-fingerprint exfiltration chain to an unrelated hard-coded endpoint. This is malicious behavior despite the absence of...

The concrete postinstall mutation of global third-party AI-agent skill directories meets the block boundary. No separate exfiltration chain is needed for this verdict.

Source inspection confirms concrete postinstall global AI-agent control-surface writes. This meets the firewall block boundary even though no credential exfiltration was found.

Source directly shows unconsented transmission of account configuration, including potentially password-bearing IMAP data, to an unrelated hard-coded host. This is a concrete credential-e...

Direct source inspection confirms an unverified remote payload is installed and executed automatically during `postinstall`. The benign exported helpers do not mitigate this concrete inst...

Source inspection confirms concrete postinstall remote payload execution, not merely suspicious primitives. The shipped API and documentation are also inconsistent with the installer beha...

Direct source inspection confirms an automatic preinstall-time DNS exfiltration of the installer hostname to an OAST endpoint. This is concrete malicious behavior, not a scanner-only infe...

Source and shipped bundles establish a concrete GET-triggered remote-download-and-write chain. The absence of install hooks does not mitigate this runtime malware behavior.

Source inspection confirms a concrete runtime remote-download-and-write chain, not merely a scanner similarity signal. The absence of lifecycle hooks does not mitigate the malicious behav...

The bundled runtime code implements concrete, unconsented host metadata collection and transmission outside the requested HTTP operation. The fixed local endpoint and altered Axios reques...

Source inspection confirms concrete remote download-and-drop behavior unrelated to the package’s metrics API. Lack of lifecycle hooks limits activation to an explicit runtime call but doe...

Direct source inspection confirms an unsolicited install-time external network request. The package contains no legitimate implementation that would justify this behavior.

Source inspection confirms a concrete unconsented postinstall write to foreign global AI-agent control surfaces. Under the firewall policy, this requires blocking regardless of the absenc...

The lifecycle hook performs concrete, unconsented harvesting of a user-owned shell configuration file and writes it outside the package. Absence of network exfiltration does not make the...

Direct source inspection confirms an unconsented postinstall remote-code execution chain. The package contains no local formatter setup implementation that would justify this behavior.