npm detections from LPM Firewall.

Source inspection confirms unconsented postinstall mutation of foreign project AI-agent control surfaces. This meets the block boundary regardless of benign-looking ancillary features and...

This package performs an unconsented `postinstall` write into foreign global AI-agent skill locations, not merely a package-owned setup directory. That meets the firewall policy's publish...

The default global capture and upload of unredacted application traffic to a hard-coded ngrok endpoint is concrete harmful behavior beyond safe package-aligned logging defaults. There is...

This package performs unverified install-time retrieval of executable and native-code payloads, then executes the retrieved binary. That is a concrete opaque remote-payload chain rather t...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic foreign AI-agent configuration mutation meets the block boundary even though no separ...

The install hook performs concrete persistence into global Claude Code configuration rather than limiting setup to an explicit user command or project-local configuration. Under the firew...

The lifecycle hook automatically initiates documented cross-agent plugin and daemon setup, rather than requiring the user to run setup explicitly. No source-visible credential theft or ne...

The lifecycle hook makes persistent changes to foreign project AI-agent instruction files by default. Although the payload is visible and package-aligned, the unconsented postinstall cont...

The lifecycle hook performs concrete, automatic writes to Claude Code and Codex configuration files that cause package-controlled MCP code to be loaded later. This meets the blocking poli...

The package performs concrete, unconsented postinstall writes to consumer AI-agent configuration paths. Although no exfiltration or remote payload execution is present, this meets the fir...

Source inspection confirms concrete import-time remote payload delivery and execution, not merely suspicious primitives. The lack of an npm lifecycle hook does not mitigate execution for...

Source inspection confirms a concrete install-time AI-agent control-surface write, not merely scanner similarity. The node_modules guard and absence of observed exfiltration do not mitiga...

This is a concrete npm postinstall mutation of foreign project AI-agent control files, including a default-all path. No network exfiltration is needed for this behavior to meet the instal...

Source inspection confirms a concrete automatic postinstall control-surface write into the host project. This meets the firewall block policy for unconsented npm lifecycle mutation of for...

Direct inspection confirms a concrete runtime exfiltration and remote-code-execution chain, not merely suspicious primitives. Absence of install hooks limits the trigger to middleware inv...

Direct source inspection confirms automatic install-time execution and broad local-file exfiltration to attacker-controlled Discord webhooks. This is concrete malicious behavior, not mere...

Source directly implements an unconsented install-time exfiltration chain rather than legitimate package behavior. The static hint is confirmed by the manifest and complete source inspect...

The source confirms the scanner’s core finding: postinstall automatically installs package-controlled Claude skills into the user’s global Claude configuration. Under the firewall policy,...

Direct source inspection confirms a postinstall hook injects package code into every Claude Code tool call and captures its inputs. Loopback defaults reduce external-exfiltration certaint...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, meeting the firewall block boundary despite otherwise recognizable MCP functionality.

The package performs an unconsented postinstall overwrite of a foreign/broad AI-agent control surface. This meets the blocking boundary despite no observed exfiltration or remote payload...