npm detections from LPM Firewall.

Direct source inspection confirms unconsented remote command-and-control behavior, arbitrary shell execution, and command-output exfiltration. The standard native-build install hook enabl...

The package implements concrete, automatic C2-driven arbitrary command execution and exfiltrates command results to a hard-coded remote host. The native addon duplicates this behavior beh...

Source inspection confirms the critical behavior rather than merely scanner similarity: the postinstall hook persistently writes package-controlled agent instructions into the consuming p...

Direct source inspection confirms an install-time persistent backdoor with npm-based command-and-control, arbitrary command execution, and data exfiltration. This is concrete malicious be...

The package contains an unconsented preinstall hook that retrieves and executes mutable remote code. This is concrete malicious install-time behavior.

The package has a concrete postinstall persistence mechanism targeting multiple foreign/broad AI-agent instruction directories. The benign binary launcher does not mitigate this automatic...

This is concrete install-time remote code execution, obscured to avoid ordinary review. The benign table-formatting entrypoint does not justify the lifecycle behavior.

The package contains a concrete, obfuscated preinstall remote payload loader rather than a package-aligned feature. This establishes malicious install-time arbitrary code execution.

The package performs an unconsented install-time write to consumer-owned AI-agent instruction files. This concrete behavior meets the blocking policy despite the absence of exfiltration o...

This is a concrete remote-code-execution loader, not a benign font-fetching implementation. Lack of install hooks reduces automatic activation but does not remove the malicious runtime at...

This is a concrete staged remote-code-execution path, not merely a static `eval` hint. Although it is not install-time, the exported package API directly executes attacker-controlled netw...

Direct source inspection confirms an unconsented install-time persistent C2 agent with arbitrary shell execution and data export. This is concrete malicious behavior, not a package-aligne...

The package performs unconsented install-time registration of a Chrome MCP bridge, a foreign/broad AI-agent control surface. No direct exfiltration was confirmed, but the lifecycle mutati...

Source inspection confirms a concrete lifecycle-triggered remote payload write into Claude Code, Codex, and OpenClaw directories. This meets the blocking policy regardless of the package'...

The package contains a concrete, unconsented postinstall mutation of foreign project AI-agent instruction files. Benign UI bundle contents do not mitigate this lifecycle control-surface h...

Source inspection confirms an install-time remote-command agent with persistence and npm-based output exfiltration. This is concrete malicious behavior, not a scanner-only inference.

Source inspection confirms a real postinstall chain that automatically installs agent skills across multiple host AI-tool directories. Documentation and prefix-scoped cleanup reduce ambig...

Broad discovery of unrelated wallet private keys is not required for normal SDK operation and is automatically consumed by default client/wallet flows. The resulting signing capability en...

Direct source inspection confirms unconsented install-time privileged account creation and credential/host exfiltration. This is concrete malicious behavior, not a scanner-only inference.

The concrete postinstall behavior mutates broad, foreign AI-agent skill directories. This meets the block boundary even though the inspected installer path showed no network exfiltration.

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces, not merely an explicit setup command. The source confirms the behavior directly.