npm detections from LPM Firewall.

Direct source inspection confirms active stealth persistence, foreground-window capture, and relay of captured content to ChatGPT. The benign postinstall hook does not reduce the runtime...

This is a concrete import-time remote code execution chain unrelated to assertion-library functionality. The absence of lifecycle hooks does not mitigate execution triggered by normal pac...

Source inspection confirms the scanner finding: the install lifecycle writes package-authored AI-agent control artifacts into the consuming project. The preservation of existing files and...

Source inspection confirms concrete install-time collection and external transmission of local host identity data. The “DEMO” description does not remove the malicious behavior.

Direct source inspection confirms automatic postinstall execution and external transmission of local hostname and username. This is concrete malicious behavior, not a package-aligned feat...

This is an unconsented install-time remote-code loader hidden inside a small local utility package. The bundled math code does not justify downloading, installing, and executing a mutable...

Concrete install-time execution performs credential/config exfiltration and remote SSH persistence. This is direct malicious behavior, not a package-aligned feature.

This is a concrete remote-code-execution loader, not a database-connector feature. Lack of an install hook reduces automatic exposure but does not remove the malicious capability.

The source establishes an unconsented install-time mutation of a broad AI-agent control surface and automatic onboarding of third-party code. This meets the firewall block boundary despit...

Source inspection confirms a concrete postinstall chain that overwrites multiple consumer-project AI-agent instruction locations and runs a broad sync command. This meets the blocking pol...

This is a concrete, automatic credential-exfiltration path rather than package-aligned mail-provider traffic or an inert debug primitive. The package should be blocked.

Source inspection confirms a concrete npm postinstall control-surface mutation, not merely scanner similarity. This meets the block boundary even though no credential exfiltration or netw...

The package contains concrete, reachable malicious document-content injection in both published runtime entrypoints. No install hook is needed for the payload to affect users processing O...

This is a concrete, unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Documentation and an opt-out do not eliminate the automatic lifecycle behavior.

Direct source inspection confirms broad Claude Code installation, execution, shim replacement, and binary/source modification during npm postinstall. This meets the block boundary for unc...

This is concrete import-time deceptive remote-content loading, not an inert helper or package-aligned network use. Although it lacks install hooks and host credential access, the external...

Direct inspection confirms unconsented postinstall mutation of global Claude Code installation files plus runtime network-control injection. This meets the firewall block boundary for for...

This is a concrete unconsented `postinstall` mutation of a foreign AI-agent control surface, meeting the block boundary. The lack of credential exfiltration does not mitigate the lifecycl...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. The benign-looking skill content does not remove the automatic overwrite behavior.

Source inspection confirms a postinstall hook modifies home-level AI-agent instruction directories outside the installed project. This meets the firewall block boundary for unconsented in...

The distributed runtime bundle appears package-aligned, but the install-time script persistently writes AI-agent control instructions into consumer projects without user consent. That con...