npm detections from LPM Firewall.

postinstall runs install/install.mjs --yes and writes OpenCode plugins, agents, skills, and config, plus global npm installs, without a user setup command. That is unconsented mutation of...

The only shipped behavior is an automatic postinstall that reads /tmp/flag.txt and sends it to an attacker-controlled ngrok URL. That is unconsented install-time data theft, not a develop...

The postinstall hook unconsented-writes Copilot, Claude Code, and Cursor control files in the consumer project and also weakens pnpm script gating via .npmrc. That is foreign and broad AI...

The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is...

This is concrete security-control tampering paired with unverified remote binary execution, not a necessary transparent CLI bootstrap. The absence of an install hook limits the trigger to...

The explicit Windows registry modification disables a protective control, and the CLI then executes unverified remote binaries with inherited environment variables. The lack of an install...

The bundles implement concrete cross-site profile harvesting and exfiltration, including Google account data, despite being presented as a lightweight analytics script. Absence of an inst...

This package contains concrete host-security weakening and concealed elevation in its user-invoked command path. The absence of an install hook does not neutralize this malicious runtime...

The package contains concrete import-time collection and external transmission of browser cookie and profile data. The absence of lifecycle hooks does not mitigate this runtime exfiltrati...

The package contains a direct, import-time profile-data transfer to an unrelated fixed endpoint. There is no legitimate package functionality or consent mechanism present in the inspected...

The package's sole entry contains direct authenticated data collection and third-party exfiltration. Absence of an install hook does not mitigate the import-time browser attack.

Source inspection confirms automatic credential and application-data collection with exfiltration to a fixed third-party endpoint. The lack of install hooks does not mitigate the maliciou...

This is concrete, automatic credential and application-data exfiltration from the package entry point. The fixed external receiver and immediate execution establish malicious behavior.

The source contains a complete, import-triggered data-exfiltration path to an unrelated external webhook. This is concrete malicious behavior even though it has no install hook.

The package embeds package-controlled remote logging defaults and automatically transmits rich application records during ordinary ScanOrder use. This is concrete data exfiltration rather...

The package embeds active third-party webhook destinations and automatically sends rich runtime records to them during normal ScanOrder use. The absence of an install hook does not mitiga...

The package contains a complete default-configured telemetry exfiltration path, not merely a reusable HTTP client. Lack of an npm install hook reduces installation risk but does not remov...

The package contains a default-enabled remote reporting channel to fixed webhook receivers and forwards rich runtime records through it. This is concrete unconsented data exfiltration des...

postinstall runs install.js, which writes bundled skills into many third-party agent skill directories without consent. That is unconsented install-time mutation of a foreign, broad AI-ag...

The postinstall hook performs unconsented writes of bundled agent skills into the shared ~/.agents/skills store and into detected third-party agent skill directories, which is foreign and...

OpenSSF Malicious Packages via OSV confirms xzvbailsx@1.0.0 as malicious (MAL-2026-16279): Malicious code in xzvbailsx (npm)