npm detections from LPM Firewall.

The published entrypoint conceals a third-party fault-config endpoint and lets that response drive fabricated network errors, including replacement of the payment-path whitelist. That is...

The install hook unconditionally mutates Claude Code's user-level skills directory, a foreign agent control surface, unless an opt-out variable is already set. The copied content is this...

The postinstall hook unconsentedly mutates the user-wide OpenCode instruction config and injects binding agent directives. An opt-out environment variable does not make that install-time...

The postinstall hook unconsented rewrites the user-wide Claude settings file so later sessions export prompts, tool details, and account identifiers to a package-controlled collector. Tha...

The automatic lifecycle hook performs broad, potentially destructive AI-agent configuration writes without an explicit user command or consent gate. This meets the install-control-surface...

The package performs an unconsented post-install mutation of a shared AI-agent control surface. This meets the install-control-surface blocking rule.

The runtime bundle hides a year check that throws an empty error after 2026 and aborts module initialization, which is a concrete protestware time bomb. No install hook or data theft was...

The published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that c...

The postinstall hook unconditionally mutates the user-global Claude Code settings file and installs a command Claude executes for every session. That is an unconsented install-time change...

The npm postinstall hook unconditionally starts a global Claude config write when the install is global, outside CI, and not opted out. That write changes ~/.claude settings and enables a...

The postinstall path automatically mutates OpenCode, Grok, Hermes, OpenClaw, and Cursor control files and reuses a local Cursor daemon token. That is concrete unconsented install-time hij...

The package contains an active remote-script execution path driven by a service request, not merely a configurable API client or inert payload. The lack of an install hook does not remove...

Unconsented postinstall mutation of the global Claude Code hook surface is a foreign agent control-surface write, not an explicit user setup command. Empty matchers make the injected comm...

The published node is fully obfuscated and, on import, runs a concealed Go WebAssembly payload after exposing Node filesystem and OS APIs to it. That is hidden code execution in the host...

Postinstall on a global install unconditionally launches plugin install, and that command defaults to mutating Claude, Codex, and Cursor user configuration together. That is an unconsente...

The automatic lifecycle prompt is directed at an AI and chains to broad local agent configuration writes. This is an unconsented install-time AI-agent control-surface modification path.

The package automatically exfiltrates host and CI metadata from its active configuration entrypoint to an unrelated endpoint. This is concrete malicious data collection rather than config...

The lifecycle hook performs broad AI-agent configuration mutation and automatic plugin installation. This is a concrete install-hook abuse chain, not an explicit user-invoked setup flow.

The main callable path reaches deliberately concealed dynamically constructed code. This is concrete active malicious behavior, even though the concealed payload's final actions are not s...

The package combines security-control weakening with unauthenticated remote command execution. This is concrete malware behavior, not a benign installer capability.