npm detections from LPM Firewall.

Static source inspection confirms unconsented import-time execution of a detached helper that retrieves and evaluates remote payloads. This is concrete malicious behavior, not merely a su...

The inspected source confirms unconsented install-time collection and exfiltration of environment and host metadata to external endpoints. The declared security-research PoC purpose does...

Source inspection confirms package.json lifecycle execution and install-time writes/registration into Trae, Cursor, Claude/MCP-style agent surfaces outside the package namespace. This mat...

Source inspection confirms automatic postinstall writes into consumer .claude agent-control paths, matching the blockable AI-agent control hijack policy. The native pruning and restart no...

Static inspection confirms concrete protestware in the shipped main bundle, despite otherwise package-aligned checkout API behavior and no install hook. Because the code can intentionally...

Direct source inspection confirms a postinstall lifecycle script that installs package-supplied instructions into multiple home-level AI-agent surfaces by default. Under the supplied inst...

Static inspection confirms no install-time malware, but the runtime bundle has a concrete hardcoded endpoint path for payment and PII collection that is not merely a noisy scanner secret....

Direct source inspection confirms a deceptive package-aligned facade with runtime remote code execution from an attacker-controlled endpoint. Lack of lifecycle hooks reduces install-time...

Static source inspection confirms lifecycle-triggered writes to foreign/broad Claude skill and MCP control surfaces, including home config files and auto-latest MCP registration. Under th...

Direct source inspection confirms an unconsented npm lifecycle hook writes package-supplied AI-agent instructions/prompts into broad home-directory Claude/Codex/Cursor-style control surfa...

This is not install-time malware, but the runtime package deliberately creates a remotely reachable AI-agent control path with normal approval/sandbox protections disabled and persistent...

The source directly implements unconsented lifecycle writes into Claude skills and MCP config surfaces, which matches the firewall policy's blockable AI-agent control hijack category even...

Source inspection confirms server-controlled remote code execution from a non-package-aligned host in a package that misrepresents its purpose. The lack of install-time execution lowers a...

Source inspection confirms import-time detached execution and network-loaded JavaScript execution unrelated to a Chai assertion plugin. The benign assertion API does not explain or justif...

The decisive behavior is not the user-invoked payment CLI itself but the unconsented postinstall installation of package-supplied instructions into broad/foreign AI-agent skill locations....

Source inspection confirms an install-time write to Claude's persistent skill directory, which is an unconsented AI-agent control-surface mutation. Although exfiltration was not confirmed...

The decisive behavior is the postinstall write of package-authored AI-agent instructions into the user's global Claude skills directory. This is not merely a runtime CLI feature because i...

The decisive behavior is the postinstall write into ~/.claude/skills, a persistent AI-agent instruction surface, using package-supplied content. Runtime network and shell behavior appears...

The concrete blocker is the unconsented lifecycle mutation of ~/.claude/skills with package-supplied agent instructions; this is not necessary for a normal npm CLI install and persists ou...

The confirmed behavior is an unconsented install-time mutation of AI-agent instruction/control files, with a runtime updater that can re-run the same mutation. This meets the firewall mal...

Source inspection confirms an install-time, unconsented AI-agent control-surface mutation, which is a concrete lifecycle attack behavior even though much runtime payment functionality is...