npm detections from LPM Firewall.

The automatic global postinstall chain delegates broad AI-client configuration writes to a remotely downloaded binary. This is concrete install-time AI-agent control-surface mutation and...

The package contains a preinstall hook that executes a shell-based external request. This is concrete install-hook abuse with no package functionality supporting it.

The sole npm entrypoint is an obfuscated remote challenge-and-redirect page, not package functionality. Its concealed request and automatic redirect constitute concrete malicious behavior.

The package's only entrypoint is a heavily obfuscated challenge-and-redirect page with a concealed remote host resolution flow. Its random package identity and lack of legitimate library...

The package contains a concealed browser-redirect mechanism behind a challenge-themed page, which is concrete deceptive behavior. Although it has no install hook, the active entrypoint is...

This is concrete, automatic install-time credential and system-data exfiltration to an unrelated Telegram endpoint. The package should be blocked.

The package implements an automatic install-time reconnaissance and external callback chain. Its research labels do not establish consent for this behavior.

The package performs automatic install-time host and environment reconnaissance followed by external transmission. Its research labeling does not establish consent for this behavior.

Automatic lifecycle execution performs unsolicited host and project reconnaissance and transmits it externally. The package's research claim does not remove this concrete install-time exf...

Automatic install-time host reconnaissance and covert transmission to hard-coded external endpoints are concrete malicious behavior. Error suppression and a DNS fallback reinforce the int...

This is concrete, unconsented install-time data exfiltration with redundant network channels. The package's research label does not neutralize the automatic behavior.

The automatic lifecycle hooks activate host and environment reconnaissance and transmit the results to an unrelated external Telegram recipient. The behavior is concrete install-time data...

This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.

The source implements deceptive process disguise, persistence, covert screen capture, and external transmission rather than the advertised DOM diagnostic function. These concrete behavior...

The source implements stealth, watchdog persistence, foreground capture, and external submission as one active workflow. Although installation itself does not activate the launcher, the c...

This is concealed, automatic host-data exfiltration through DNS during installation, unrelated to the stated Solana library function. The behavior is concrete malicious install-time data...

Automatic lifecycle execution combines local data collection with outbound transmission to unrelated collectors. This is malicious install-hook data exfiltration.

Automatic lifecycle execution collects sensitive local and build-environment data and sends it to unrelated external hosts. This is concrete malicious install-time exfiltration.

The package performs an unconsented, remotely controlled account mutation through its normal runtime entrypoint. This is concrete malicious behavior and warrants blocking publication.

The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.