npm detections from LPM Firewall.

Static inspection confirms install-time mutation of Cursor/Claude/Codex agent control files and hook execution surfaces, which is not a normal passive library install behavior. The behavi...

Direct source inspection confirms install-time writes into Claude's skills directory with autonomous agent instructions, which is a concrete AI-agent control-surface mutation outside norm...

The suspicious behavior is not merely a wrapper or package-aligned CLI capability; the lifecycle hook automatically invokes an agent-skill installer during npm install. Under the firewall...

Although many capabilities are package-aligned for an AI workflow CLI, installing AI-agent control files at lifecycle time is an unconsented control-surface mutation. No exfiltration was...

Runtime Sentry reporting can be package-aligned, but executing it automatically from preinstall with a hardcoded DSN and public-IP collection creates concrete unconsented install-time dat...

Source inspection confirms install-time writes of AI-agent rule files into the consumer project root. Even though the content is package-aligned and no traditional malware behavior was fo...

Although the package is otherwise transparent and lacks exfiltration or destructive behavior, the global postinstall hook performs an unconsented lifecycle write into Claude Code's skill...

Direct inspection confirms concrete AI-agent control-surface mutation: the installer writes Claude settings that bypass permission checks and expands trusted token-provisioning behavior....

Static inspection confirms unconsented lifecycle mutation of a host AI-agent control surface via postinstall, which is blocking behavior for the firewall even without credential theft or...

Static source inspection confirms unconsented lifecycle mutation of Codex/Claude agent skill and hook configuration, which is a concrete publish-block condition even though the CLI behavi...

The package has substantial benign, user-invoked media/OSINT functionality, but the postinstall script performs a concrete unconsented mutation of an AI-agent dependency config file. That...

Static inspection confirms install-time writes to OpenCode control-surface configs; under the firewall policy this is blocking behavior even though the implementation otherwise appears pa...

The package does not show credential theft, exfiltration, persistence, or destructive behavior, and scanner blob findings are package-aligned skill assets. However, the npm lifecycle hook...

Direct source inspection confirms a non-package-aligned remote fetch plus eval path in the CommonJS entrypoint, while benign SVG utilities do not justify this behavior. The package should...

Static source inspection shows the package is purpose-built for mass phishing/spam and sender impersonation, with obfuscated implementation and webmail auto-send behavior. The install hoo...

Source inspection confirms concrete unconsented install-time remote code execution via a remote bundle and npm install/require chain. The behavior is not necessary for the advertised Kell...

Static inspection confirms concrete runtime mutation of Claude Code permission settings to bypass tool checks and authorize credential provisioning; this is not merely scanner noise or in...

Static inspection confirms unconsented lifecycle AI-agent control-surface mutation via postinstall writes to .claude, matching the firewall block boundary. No credential theft or network...

OpenSSF/OSV malware advisory MAL-2026-6731 blocks this version. ue-jenkins-buildkite@99999.0.0 is a dependency-confusion package targeting an internal Epic Games / Unreal Engine CI namesp...

OpenSSF/OSV malware advisory MAL-2026-6729 blocks this version. package.json declares a preinstall lifecycle script that fires automatically on npm install. The script collects installer...

OpenSSF/OSV malware advisory MAL-2026-6737 blocks this version. The package.json preinstall script auto-executes on `npm install` and performs installer-side reconnaissance and credential...