npm detections from LPM Firewall.

The automatic lifecycle hooks activate host and environment reconnaissance and transmit the results to an unrelated external Telegram recipient. The behavior is concrete install-time data...

This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.

The source implements deceptive process disguise, persistence, covert screen capture, and external transmission rather than the advertised DOM diagnostic function. These concrete behavior...

The source implements stealth, watchdog persistence, foreground capture, and external submission as one active workflow. Although installation itself does not activate the launcher, the c...

This is concealed, automatic host-data exfiltration through DNS during installation, unrelated to the stated Solana library function. The behavior is concrete malicious install-time data...

Automatic lifecycle execution combines local data collection with outbound transmission to unrelated collectors. This is malicious install-hook data exfiltration.

Automatic lifecycle execution collects sensitive local and build-environment data and sends it to unrelated external hosts. This is concrete malicious install-time exfiltration.

The package performs an unconsented, remotely controlled account mutation through its normal runtime entrypoint. This is concrete malicious behavior and warrants blocking publication.

The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

The package uses automatic install hooks solely to make an external request to an unrelated endpoint. Although no credential theft or local mutation was found, this is concrete unsolicite...

This is a concrete install-time reconnaissance and data-exfiltration path to an unrelated fixed endpoint. It is malicious install-hook abuse, not package-aligned setup.

This is concrete import-time environment exfiltration followed by remotely supplied code execution. The lack of an install hook does not reduce the risk to consumers that load the package.

This is concrete concealed code execution, not environment configuration behavior. The automatic entrypoint calls and hidden encoded PowerShell launcher warrant blocking publication.

This is a concrete automatic postinstall chain that modifies a consumer project's lifecycle configuration and broad AI-agent control surface. The absence of observed network or credential...

This package embeds an import-time backdoor that overwrites a foreign dependency and remotely directs authenticated newsletter follows. The absence of an npm lifecycle script does not rem...

The package contains a concrete import-time backdoor that mutates a third-party dependency and remotely directs authenticated account actions. The absence of an npm lifecycle hook does no...

The active package entrypoint automatically collects browser session-related data and forwards it to another endpoint. This is concrete malicious credential and data exfiltration behavior.

The package performs automatic postinstall AI-agent configuration rather than requiring an explicit user command. This meets the install-control-surface blocking policy.

The automatic lifecycle hook contains a remote interactive-shell pattern and external data-posting command. This is malicious install-hook abuse.

This is an unconsented postinstall mutation of foreign AI-agent control surfaces with persistent command hooks. The qualifying guards do not remove the automatic lifecycle trigger.