npm detections from LPM Firewall.

Although the skill content is product-aligned and classic credential theft was not found, the package uses npm postinstall to write package-supplied Claude instructions into ~/.claude and...

Source inspection shows concrete phishing/spam automation, sender spoofing, webmail injection, and evasion features rather than benign package-aligned functionality. The install hooks are...

OpenSSF/OSV malware advisory MAL-2026-6757 blocks this version. On import of the server entry module, a top-level try block detaches a shell process that (1) appends an attacker-controlle...

OpenSSF/OSV malware advisory MAL-2026-6756 blocks this version. On import of dist/server/index.js, a top-level block spawns a detached shell that (1) appends a hardcoded attacker ssh-ed25...

OpenSSF/OSV malware advisory MAL-2026-6755 blocks this version. package.json declares a postinstall lifecycle script that runs `node -e` code opening a TCP connection to 185.112.147.174:7...

Source inspection confirms unconsented persistent mutation of broad/foreign AI-agent control surfaces from the package entrypoint, plus shell persistence and dangerous permission-bypass a...

This matches the firewall policy's blockable case: lifecycle-triggered, unconsented writes into foreign/broad AI-agent control surfaces such as ~/.claude skills, ~/.claude.json MCP, and C...

Although there is no npm lifecycle hook, the package's primary bin command performs unprompted broad AI-agent control-surface mutation and persistence-like shell startup changes, then sup...

Source inspection confirms a concrete install-time destructive action via rmSync against broad global/user binary paths. Package-aligned CLI env sync and auth behavior is not itself malic...

The CLI bundle's network and secret handling is aligned with an environment/secrets manager, but the postinstall hook performs destructive filesystem changes outside the package without u...

Static source inspection confirms lifecycle-triggered writes into ~/.claude/skills, a foreign/broad AI-agent control surface covered by the block policy. The absence of network exfiltrati...

The package performs an unconsented install-time write into ~/.claude/skills, a foreign AI-agent control surface, which matches the blockable AI-agent control hijack policy even though th...

Source inspection confirms install-time global Codex config mutation and remote MCP registration, matching the policy's blockable unconsented AI-agent control-surface write. The behavior...

The inspected source shows unconsented install-time mutation of ~/.claude/skills, a foreign AI-agent control surface covered by the block policy. Product-aligned content does not neutrali...

Static inspection confirms the scanner's critical finding: npm postinstall writes Claude skills and MCP registrations into user-level Claude control surfaces. Under the provided install-c...

Static inspection confirms unconsented install-time mutation of ~/.claude/skills, a foreign/broad AI-agent control surface, via package lifecycle script. Under the provided install contro...

This matches the blockable policy for unconsented lifecycle mutation of foreign or broad AI-agent control surfaces, even though the content appears package-aligned and no exfiltration end...

Direct source inspection confirms postinstall credential, file, and wallet collection with network exfiltration to Telegram. This is concrete malicious behavior and not package-aligned wi...

Source inspection confirms unconsented postinstall writes into ~/.claude/skills, which the policy treats as blockable AI-agent control hijack even when the planted instructions are produc...

Direct source inspection confirms a runtime fetch-and-eval path for remote JavaScript, which is a concrete remote-code execution/staged payload behavior. The absence of install hooks redu...

Direct source inspection confirms unconsented lifecycle mutation of multiple foreign/broad AI-agent control surfaces, which the policy treats as blockable AI-agent control hijack even whe...