npm detections from LPM Firewall.

The postinstall hook mutates project and user-home AI agent control files for OpenCode, Cursor, Hermes, and OpenClaw without a separate user command. That is unconsented install-time cont...

Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfil...

Load-time execution in the main and CLI bundles extracts a concealed command from a bundled JPEG and runs it through hidden PowerShell, which is a concrete remote-code dropper. The readab...

The install script and package entry are wired to an obfuscated probe that DNS-resolves a hostname containing the username, hostname, and directory name to oob.algamil7x.xyz. That is inst...

The install hook and package entry load obfuscated code that DNS-exfiltrates host and directory identity to oob.algamil7x.xyz. The web-component exports do not account for that hidden loo...

The postinstall hook automatically runs a broad plugin install into Claude, Codex, and Cursor user configuration during a global package install. That is unconsented lifecycle mutation of...

A global npm postinstall automatically installs this package's plugin into Claude, Codex, and Cursor and rewrites the user Codex config, which is an unconsented broad agent control-surfac...

The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diag...

Unconsented postinstall mutation of user-global ~/.claude/settings.json enables prompt and tool-content export to a package-controlled collector. That is an active agent-control hijack, n...

Global postinstall unconditionally mutates foreign, broad agent control surfaces, including Cursor, Claude, and Codex config, command, and skill files. That is unconsented install-time ag...

OpenSSF Malicious Packages via OSV confirms @mr-supun-fernando/supunmd-bail@3.0.3 as malicious (MAL-2026-16387): Malicious code in @mr-supun-fernando/supunmd-bail (npm)

Postinstall unconditionally mutates the user-wide Claude Code control surface and enables prompt and tool telemetry to a package-controlled collector. That is unconsented install-time age...

The postinstall path is an automatic global-install write into Claude Code's broad settings and hook surface, including tool-use interceptors and a third-party plugin pin. Opt-out flags a...

The postinstall hook unconditionally replaces directories in the consumer project's .claude/skills with a package-supplied Claude skill that auto-triggers on generic UI requests. That is...

The package has no install hook, but its active browser entrypoint automatically executes a remotely hosted, mutable JavaScript payload. This is concrete remote code execution exposure ra...

The automatic postinstall performs unconsented, overwrite-enabled mutation of broad AI-agent control surfaces. This is concrete install-hook abuse under the stated policy.

This is concrete, unconsented postinstall mutation of foreign and machine-level AI-agent control surfaces. The lifecycle hook abuse warrants blocking even without demonstrated credential...

The automatic postinstall modifies a foreign, user-level Claude Code configuration and enables export-oriented telemetry for prompts, responses, and tool details. This is concrete install...

This is an unconsented automatic install-time mutation of foreign AI-agent control surfaces. The opt-out and name check do not change that the deletion is triggered by installation.

The package performs destructive, broad consumer-project mutation from an automatic install hook. This is a concrete unconsented install-time attack surface even though the inspected hook...

Postinstall unconditionally mutates the global Claude Code settings file to export prompt and tool content to a package-controlled collector. That is unconsented install-time control of a...