npm detections from LPM Firewall.

This is a concrete browser-side remote payload chain rather than a benign utility: it automatically obscures the host UI and hands control to an external page. No lifecycle hook is needed...

Source inspection confirms automatic, full-screen delivery of remotely controlled external content on import. No install hook is needed for this malicious runtime behavior.

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. The lack of exfiltration does not mitigate the install-control-surface violation.

Direct inspection confirms concrete, unsolicited install-time collection and external exfiltration with no package-aligned functionality. This meets the blocking threshold for malicious b...

The package contains an explicit detached remote-code loader activated by normal middleware use. Absence of an install hook does not mitigate runtime arbitrary code execution.

Source inspection confirms a concrete, obfuscated runtime dependency-install and execution chain triggered by normal documented APIs. Lack of an npm lifecycle hook limits the trigger but...

Direct source inspection confirms an unconsented `postinstall` writes package-supplied, auto-invocable instructions into foreign global AI-agent control surfaces. This meets the blocking...

Static inspection resolves the prior manual review: despite package-aligned media rendering code and no install hook, the bundle contains a reachable external JavaScript loader whose fixe...

This is a policy-defined AI-agent control hijack: normal registry installation modifies foreign project and home AI-agent control surfaces and registers an executable MCP server without r...

Source inspection confirms unconsented install-time mutation of global Codex configuration, instructions, and skills. This meets the blocking boundary even though no separate credential t...

Source inspection confirms a concrete remote payload fetch-and-execute chain, independent of scanner labels. The lack of install hooks does not mitigate runtime arbitrary code execution i...

This is concrete unconsented install-time telemetry exfiltration, not merely a dormant capability. The inert runtime module does not mitigate the preinstall beacon.

Source confirms a concrete unconsented postinstall mutation of consumer-project AI-agent control files. The absence of exfiltration does not remove this foreign broad control-surface hijack.

The install hook automatically initiates persistence and agent-plugin setup rather than requiring an explicit user command. The absent platform binary prevents deeper payload inspection b...

The lifecycle script creates or alters project-level AI-agent instruction files by default, satisfying the concrete install-time control-hijack boundary. Other observed network and CLI ex...

This is a concrete remote code execution backdoor, not required for SVG retrieval. Absence of install hooks limits automatic activation but does not remove the malicious exported capability.

The inspected wrapper establishes an automatic postinstall path into documented daemon and AI-agent plugin setup. The package does not need to harvest credentials for this to warrant bloc...

Source inspection confirms unconsented postinstall modification of a foreign AI SDK OAuth callback page. Although no credential exfiltration or network activity was found in the hook, thi...

The wrapper source establishes an automatic install-time path into documented agent-plugin and persistent-daemon setup. Although the binary is absent and no exfiltration is shown, this me...

Source inspection confirms an automatic postinstall write to both `~/.claude/skills` and `~/.agents/skills`, which is a foreign/broad AI-agent control surface. The unattended global updat...

Source inspection confirms a concrete postinstall write into foreign global AI-agent skill directories. Under the install-control-surface policy, this requires blocking regardless of othe...