npm detections from LPM Firewall.

Source inspection confirms concrete runtime credential capture of a broad MCP_API_KEY and transmission to the package's external service, not merely scanner noise. Lack of install hooks a...

Although the CLI runtime behavior is largely aligned with LSP/refactoring functionality, the unguarded install-time write into ~/.claude/skills matches the policy for unconsented lifecycl...

Source inspection confirms lifecycle-triggered remote shell execution and binary replacement; this is a concrete install-time dangerous capability even though the endpoint is package-alig...

The confirmed issue is not classic malware or exfiltration, but the package uses an npm lifecycle hook to plant agent skill files into a project-level .opencode control surface without co...

Although the skill content appears product-aligned and no exfiltration or shell execution was found, the unconsented postinstall write into a broad AI-agent control surface matches the bl...

The package has no credential theft, exfiltration, remote code execution, or destructive runtime behavior, but the postinstall hook unconditionally plants AI-agent skill files into a proj...

The package has benign runtime book-writing code, but its install hook unconditionally writes package instructions into a project-level AI-agent skills directory. Under the install contro...

The runtime library is benign local code analysis, but the lifecycle hook unconditionally plants agent instructions into a project-level .opencode skill surface. Under the install control...

Source inspection confirms automatic lifecycle installation into .opencode/skills, which falls under unconsented AI-agent control-surface mutation. The absence of exfiltration or classic...

The package has concrete malicious install-time behavior: a hidden obfuscated postinstall with host reconnaissance, command execution primitives, filesystem mutation, detached execution,...

Source inspection confirms a malicious install-time hook with hidden execution, persistence-like detached launch behavior, and system telemetry collection. The benign README and metadata...

The lifecycle hook is a concrete install-time dropper/launcher, not merely telemetry or package-aligned setup. The obfuscation, anti-analysis, detached execution, and broken advertised mo...

The package has concrete unconsented install-time execution with obfuscation, process spawning, filesystem mutation, and telemetry behavior that exceeds the declared ESLint-config purpose...

Although the payload is a notification feature and no exfiltration is present, the package uses an npm postinstall hook to modify ~/.claude/settings.json and register Claude Code executio...

Although the content is product-aligned and there is no exfiltration or remote code execution, lifecycle-triggered writes into ~/.claude/skills are an unconsented mutation of a foreign AI...

The package's core behavior is an install-time rewrite of Claude Code's global hooks/settings, which matches the blockable AI-agent control-hijack policy even though no classic malware or...

Although the payload is product-aligned and lacks network exfiltration, it is lifecycle-triggered and unconditionally rewrites a broad foreign AI-agent control surface under ~/.claude. Un...

Direct source inspection confirms the only substantive behavior is an automatic postinstall command with no legitimate package purpose. Although there is no exfiltration or persistence, u...

The source establishes a concrete install-time remote payload path with disabled TLS verification and no integrity check. Even without credential theft or immediate binary execution, this...

Source inspection confirms a lifecycle-triggered remote executable payload install from a non-registry IP endpoint with TLS verification disabled. Even without credential theft or immedia...

Static source inspection confirms install-time code plants repository-wide AGENTS.md instructions, which the supplied policy treats as blockable AI-agent control hijack when lifecycle-tri...