npm detections from LPM Firewall.

The automatic postinstall mutation of shared global commands used by AI agents is a concrete, unconsented broad control-surface change. The additional unpinned install-time dependency fet...

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.7 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.5 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.4 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

The automatic postinstall hook mutates a consumer-owned Claude Code configuration and removes existing files. This is concrete unconsented install-hook abuse despite the absence of observ...

The automatic lifecycle hook mutates the consumer project's Claude Code configuration area, including deletion and installation of skill instructions. This meets the install-control-surfa...

The package has a concrete automatic install-time exfiltration path, not merely a suspicious primitive. Its simple runtime export does not mitigate the lifecycle-hook behavior.

This is unconsented postinstall mutation of a broad AI-agent control surface, coupled with credentialed external data transmission. The documented feature purpose does not remove the auto...

The automatic cross-account sharing is concrete, undisclosed data disclosure behavior. The package also embeds AI-agent control instructions, reinforcing malicious intent.

Source directly establishes default routing of supplied Facebook credentials to a fixed third-party host. The absence of an install hook does not remove this runtime credential-exfiltrati...

Importing the package runs a packed dropper that collects host identity, talks over axios, and executes decoded code with Function and execSync. The Pino-looking docs and empty middleware...

The postinstall hook automatically writes branded skills into many third-party agent skill directories. That is unconsented install-time mutation of a foreign, broad AI-agent control surf...

Runtime defaults post Facebook email, password, and 2FA to a hardcoded unofficial host, and session recovery does the same when credentials are configured. The example config names a diff...

The install hook writes into the consumer .claude/skills directory, which is an unconsented foreign AI-agent control surface. That matches publish-block hijack even though the skill text...

The postinstall hook writes Claude Code skills into the installing project's .claude/skills directory without a user command. That is unconsented mutation of a foreign AI-agent control su...

This is a concrete remote code execution path in the package's exported runtime artifact, with no integrity control over the downloaded JavaScript. The absence of an npm lifecycle hook do...

The automatic postinstall hook reaches broad foreign AI-agent control surfaces and writes package-provided skills into them. This is concrete unconsented install-hook abuse even though th...

Default npm postinstall copies this package's skill pack into ~/.clawdbot/skills and force-links it into ~/.claude, ~/.codex, and ~/.agents without an explicit user command. That is uncon...

Source shows always-on silent fetches of account emails and JSON IMAP configs, including passwords, to rmf39.aaz.lt during normal runtime init. That is concrete credential exfiltration, n...

This package contains a concrete install-time remote payload replacement path, not a transparent local setup step. It changes executable package source and its manifest without user actio...

The published runtime combines automatic source-code uploads with broad credential forwarding to a remote endpoint. Although activation is user-invoked and not install-time, this is concr...