npm detections from LPM Firewall.

This is an unconsented install-time mutation of a foreign AI-agent control surface, accompanied by persistent user-environment and launcher changes. The isolated virtual environment does...

Global npm install runs postinstall.js, which downloads a native binary without integrity checks and executes it with --configure-clients so it can write this package into other AI apps'...

The CLI prompts for THENUX keys from api.thenuxofc.store, persists them, and by default posts them to an undocumented workers.dev gateway. That is a hidden default export of user credenti...

The active Android entrypoint reaches a bundled sink that exports serialized IMAP configuration, which can include passwords, to a hardcoded third-party host. This is concrete credential...

This is an unconsented postinstall chain that mutates broad AI-agent control surfaces and establishes login persistence. The absence of outbound exfiltration does not neutralize the concr...

The package performs unconsented postinstall mutation of broad AI-agent control surfaces and establishes persistence. This meets the install-control-surface blocking rule even though the...

This is a concrete unconsented postinstall chain that mutates broad AI-agent configuration surfaces and registers persistence. The loopback-only dashboard and lack of observed credential...

This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces, with instructions that redirect sensitive wallet workflows. The automatic hook is sufficient conc...

Global postinstall runs prumo install --all and mutates Claude, Codex, and Kiro control surfaces without an explicit user install command, which is unconsented foreign agent-config writes...

Global postinstall runs unattended prumo install --all, which writes this package's skill and always-on PO First instructions into Claude Code, Codex, and Kiro user configs and registers...

The credential destination mismatch is concrete in the active CLI path, and the package forwards tool results to the same remote service. This is credential and data exfiltration behavior...

The automatic lifecycle hook performs concrete, broad mutation of the consumer's AI-agent workspace, including deletion. This meets the install-time agent-control-surface blocking policy.

npm postinstall mutates every detected coding-agent MCP config and then fetches an unsigned native zip from updater.kogiqa.com with no integrity check. That is unconsented foreign agent-c...

The package contains a reachable default export path for runtime records to hardcoded third-party webhooks and an unrestricted token-forwarding primitive. Caller overrides do not remove t...

The postinstall script executes a native binary with --install-agent-hooks, and the package states that this writes Codex and Claude Code hooks without a separate user command. That is un...

The published postinstall mutates foreign AI-agent instruction files without consent, which is install-time control-surface hijack. The bundled CLI is a user-invoked wallet product and do...

The postinstall hook automatically runs connect install, which copies this package's skills into many third-party agent skill directories under the user home. That is unconsented install-...

The postinstall script silently writes Agentgates command instructions into Claude Code, Cursor, and Windsurf user config files, which is unconsented mutation of foreign AI-agent control...

The postinstall hook drives a third-party Chrome MCP bridge to register a native messaging host without a user command, which is unconsented mutation of a foreign AI-agent control surface...

Postinstall downloads and installs an unsigned native binary from a hardcoded IP with TLS verification disabled, then the CLI executes it. That is a concrete remote payload chain, not a f...

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, AES-decrypts, and follows a remote redirect_url. That is concrete malware behavior even though npm install its...