npm detections from LPM Firewall.

The postinstall script executes a native binary with --install-agent-hooks and the package text states that this writes Codex and Claude Code hooks, skills, and Codex settings. That is un...

Postinstall automatically executes a native binary with --install-agent-hooks, and the package says that writes Codex and Claude Code hooks, skills, and Codex update settings. That is unc...

The package has a concrete automatic postinstall chain that executes an opaque native hook installer against Codex and Claude Code configuration. This meets the install-time AI-agent cont...

Inspected source shows import-time localStorage token theft and a fetch POST with no legitimate widget code. That is concrete credential exfiltration, so the package is blocked.

The package contains a reachable remote-code execution path: it downloads and evaluates JavaScript at runtime. The absence of install hooks reduces install-time risk but does not remove t...

This is an unconsented install-time mutation of foreign AI-agent control surfaces combined with remote executable loading and broad host changes. The global-install gate and opt-outs do n...

The hard-coded remote destination receives an environment credential without a configurable or source-verifiable authorization boundary. Although activation is user-invoked and there is n...

The source establishes a complete remote-response-to-dynamic-execution path. Although it is not install-time behavior and appears product-related, executing service-supplied code in a con...

The package has a concrete automatic postinstall chain that modifies multiple third-party AI-agent skills directories and changes future agent routing. This meets the install-control-surf...

postinstall copies and prunes a skill tree into Codex and Claude user skill directories, which is unconsented mutation of foreign AI-agent control surfaces. README wording and opt-in skil...

The package contains a concrete credential-exfiltration path through a hard-coded remote logging endpoint. Absence of an npm lifecycle hook does not remove the runtime risk.

The hard-coded removal of a purported competitor is destructive behavior, and the automatic patch configuration deliberately disables multiple agent control protections. No install hook e...

index.js is an import-time localStorage thief that POSTs the dump to /addPost, with no legitimate helper surface. That is concrete client-side exfiltration, not a noisy network primitive.

index.js is an import-time scrape-and-post payload that copies .flag-value from /profile to /addPost, which does not match a feed widget helper. That is concrete data theft even though th...

index.js is a load-time same-origin thief: it scrapes .flag-value from /profile and POSTs it to /addPost with no user API. That is a complete data-theft chain, not a documented widget.

The automatic postinstall chain fetches and executes an opaque native payload, then targets pre-existing Claude or Codex configuration through install-hooks --all. This is a concrete unco...

postinstall writes a bundled agent skill into ~/.codex/skills and ~/.claude/skills, which is unconsented mutation of foreign AI-agent control surfaces. That matches a blocking install-tim...

The postinstall hook writes FocalAPI skills into many third-party agent skill directories under the user home without a separate user command. That is unconsented install-time mutation of...

The published main module is only an import-time fetch of /Profile followed by a POST of that body to /addPost, with no helper API. Combined with an empty manifest and no install hooks, t...

This package creates a concrete automatic supply-chain payload path by accepting and deploying an opaque remote native binary without certificate or integrity verification. The lifecycle...

The postinstall hook writes a packaged skill into Codex and Claude user skill directories without a user command, which is unconsented mutation of foreign AI-agent control surfaces. READM...