npm detections from LPM Firewall.

This is a typosquat of the official Tailwind PostCSS plugin with a hidden SVG-comment loader. On plugin run it decodes and executes arbitrary JavaScript from project SVG files, which is c...

The package routes user-supplied Facebook credentials to a fixed unrelated gateway during standard login. No install hook is needed for this concrete credential-exfiltration behavior.

The main entrypoint is an import-time IIFE that hunts local flag and admin pages and POSTs the results to webhook.site. That is a complete exfiltration chain even without npm install hooks.

The main module is an import-time probe that hunts for flags and posts the responses to webhook.site. That is concrete exfiltration, not a legitimate package feature.

The declared entrypoint performs direct, unconsented data exfiltration to a fixed third-party endpoint. The absence of lifecycle hooks does not remove the import-time attack surface.

The package's import-time entrypoint exfiltrates profile content and diagnostics to an unrelated external webhook. The absence of an install hook does not mitigate this concrete runtime d...

index.js is a side-effecting import-time fetch that forwards remote profile data and errors to webhook.site, which is a concrete exfiltration sink rather than a library. Empty metadata an...

The only source file is an import-time fetch of /profile that posts the body or error details to webhook.site. That is concrete data exfiltration, not package-aligned networking.

Automatic postinstall copies FocalAPI skills into every detected third-party agent skills directory without an explicit connect command. That is unconsented mutation of a foreign and broa...

The only runtime code is an import-time steal of /profile posted to webhook.site, which is concrete data theft rather than a library. Empty metadata and a main entry that only performs th...

This is concrete runtime data exfiltration, not merely a network-capable chat API: received photo attachment URLs are silently forwarded to ImgBB. The lack of an install hook does not mit...

The automatic installation of a separate vendor's global AI-agent CLI and persistent host configuration mutation creates an unconsented foreign agent control surface. No self-dependency o...

This is a concrete automatic install-hook chain that downloads and executes unverified remote native code while modifying the user environment. The lifecycle hook obscures errors, increas...

OpenSSF Malicious Packages via OSV confirms idx_form_script@999.0.2 as malicious (MAL-2026-16243): Malicious code in idx_form_script (npm)

The automatic postinstall hook broadly mutates foreign AI-agent control surfaces, which meets the install-control-surface blocking policy. The absence of a JavaScript network request does...

The package's postinstall path automatically executes an opaque native hook installer, including after downloading an unverified executable. This is a concrete unconsented AI-agent contro...

Source inspection confirms automatic postinstall registration of a foreign Claude Chrome MCP bridge, which is a broad AI-agent control-surface mutation. The unchecked remote binary downlo...

postinstall launches a native --install-agent-hooks installer that README describes as writing Codex and Claude Code hooks, skills, and a Codex setting. That is unconsented install-time m...

The postinstall hook does not only write a config file; it starts a tunnel path that can plant an SSH key on a remote host and a local unauthenticated control server. That is concrete ins...

Source shows an automatic postinstall that writes this package's skills into many third-party agent skill directories, which is unconsented mutation of a foreign and broad AI-agent contro...

The package automatically exports full traced URLs to a vendor endpoint while constructing URLs that embed bearer tokens. This is a concrete credential-exfiltration path, not ordinary use...