npm detections from LPM Firewall.

The package has a postinstall hook that modifies broad, foreign AI-agent control surfaces in the user's home directory. This meets the install-control-surface blocking rule even though no...

The package exports a local service credential to a fixed unrelated external recipient by default, which is concrete credential exfiltration. Embedded administrator credentials add a sepa...

The active entrypoint implements unsolicited browser credential and data collection followed by transmission to an unrelated external endpoint. This is concrete credential and data exfilt...

The automatic lifecycle hook provisions a foreign AI-agent CLI and persists shell configuration changes. This is concrete unconsented install-time control-surface mutation.

The package performs an unconsented postinstall invocation that installs AI-agent skills at project or global scope. This meets the install-control-surface blocking rule.

The package combines automatic lifecycle execution with writes to a foreign DSH host and user agent-skill catalog. The stated safeguards limit when files are changed but do not remove the...

This is unconsented post-install mutation of foreign, broad AI-agent control surfaces. It meets the blocking policy for AI-agent control hijacking.

The package performs automatic npm lifecycle mutation of global Claude Code and Codex MCP settings. This is a concrete AI-agent control-surface hijack under the install policy.

The automatic postinstall hook overwrites a foreign, potentially shared FastMCP consent implementation. This is concrete install-hook abuse of an AI-agent control surface.

The automatic postinstall performs remote code execution and changes a foreign AI-agent configuration without requiring an explicit setup command. This meets the install-control-surface b...

The package uses an automatic install hook to execute a remotely fetched shell installer and configure a separate AI-related tool in the user's environment. This is an unconsented lifecyc...

The automatic global installation and use of third-party AI credential tooling is a concrete, unconsented install-time control-surface mutation. It meets the blocking policy for postinsta...

The package performs an unconsented postinstall write to a user's OpenCode configuration, causing a package-supplied plugin to load. This meets the install-time AI-agent control-surface m...

The automatic, forced user-scope agent-skill installation is concrete install-hook abuse. Its global scope and behavior-changing instructions meet the blocking policy even without evidenc...

The published postinstall hook mutates foreign agent control surfaces, including OpenCode config, Hermes under the user home, and Cursor hooks, then reuses a local daemon bearer token to...

Importing the package runs an obfuscated loader that shells out through execSync and prepares host and username collection plus an axios send. That is concrete remote command execution hi...

Import of the published entrypoint is a dropper: it decrypts a concealed payload with a hardcoded key and writes an executable while deleting the staging file. The image-conversion API do...

Import-time code hides an AES dropper behind an image-conversion API and plants a mode-0700 executable from a concealed temp payload. That is concrete malware behavior even though this fi...

The automatic lifecycle hook writes package-controlled content into foreign global agent directories, meeting the install-control-surface blocking condition. The additional user-level pip...

The source establishes a complete automatic lifecycle path from package installation to a global foreign AI-agent CLI installation. Under the install-control-surface policy, that is block...

The postinstall hook unconditionally plants framework files in .claude and .agents and registers Copilot command hooks, which is unconsented install-time mutation of foreign and broad AI-...