npm detections from LPM Firewall.

The automatic postinstall performs broad, unconsented mutation of an external AI-agent configuration and establishes a lifecycle self-dependency chain. This is concrete install-hook abuse...

The preinstall hook performs broad host reconnaissance and deliberately publishes the report world-readable under /tmp for a less-privileged reader. That is concrete install-hook abuse ev...

The preinstall hook unconditionally performs broad host and container-escape reconnaissance and stores it on disk, which is concrete install-hook abuse. Claims that the package is a read-...

Unconsented postinstall mutation of the OpenClaw skills directory is a foreign AI-agent control-surface write. The skill content is product documentation, but that does not remove the aut...

Unconsented postinstall mutation of the OpenClaw skills directory is a foreign agent control-surface write, so the package is malicious install behavior. The CLI's later user-configured A...

The package performs unsolicited external callbacks during installation through a postinstall hook. This is concrete dependency-confusion install tracking and warrants blocking.

Postinstall unconditionally launches a downloaded binary that installs hooks into existing Claude Code and Codex directories, which is an unconsented mutation of foreign agent control sur...

The postinstall hook unconditionally mutates user-level Claude and Codex MCP configuration, which is an unconsented install-time write to foreign agent control surfaces. The server is loc...

The npm postinstall hook unconditionally mutates Claude Code and Codex configuration to register this package's MCP server. That is unconsented install-time mutation of foreign AI-agent c...

The package hides a remote payload launcher inside a fake certificate and triggers it through its advertised API. This is concrete malicious remote code execution.

The install-triggered, obfuscated DNS request transmits host and project metadata to an unrelated external domain. This is concrete covert data exfiltration, not a normal design-system ru...

The automatic postinstall chain writes package content into a broad, foreign AI-agent configuration surface. Under the install-control-surface policy, this is blockable lifecycle abuse.

The install hook unconditionally writes a foreign, user-scoped Claude MCP registration and skill files, and pins that registration to a floating amicus@latest command. That is unconsented...

The package performs an unconsented post-install mutation of a foreign, user-wide AI-agent control surface. This meets the install-control-surface blocking policy.

The browser bundle contains an active, unrestricted remote script-loading path driven by task data. This creates a concrete remote-code execution surface in applications that use the SDK.

The published entrypoint is an obfuscated loader that detects debugging and then decrypts and compiles a hidden embedded script. That is concrete concealed execution, so the package shoul...

This is concrete unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle behavior meets the install-hook abuse blocking policy even though no network exfiltrat...

The launcher, overlay, screen grabber, and browser-cookie decryptor are concrete stealth and credential-theft behavior under a false package description. Install does not auto-start them,...

This is an active, obfuscated install-time metadata exfiltration path. It has no necessary relationship to a global-header component.

The published socket path silently subscribes the connected WhatsApp account to a publisher-selected newsletter, which is concrete unconsented account abuse. The obfuscated timer, swallow...

Shipped code hides from agent sessions, tampers with OS security controls, executes a remotely supplied command, and writes foreign AI-assistant MCP configs to the current executable. The...