npm detections from LPM Firewall.

The automatic postinstall chain performs broad SSH and system mutations, including remote authorized-key installation and persistent background services. This is concrete install-hook abu...

This is an unconsented postinstall mutation of a consumer AI-agent control surface, including recursive deletion of existing configuration. The lifecycle behavior meets the install-hook a...

The postinstall hook mutates Claude Code's user settings file and turns on remote logging of prompts and replies without consent. That is unconsented install-time hijack of a broad agent...

This is an unconsented install-time system modification with privileged command attempts, not ordinary dependency setup. The repeated startup path increases the persistence of that behavior.

postinstall rewrites user-global Claude Code settings and enables prompt, reply, and tool telemetry to otel.togaiq.com, including on installs that never open a project. That is unconsente...

Source shows an automatic postinstall that mutates Claude Code and Codex control-plane files, which is unconsented foreign agent-surface hijack. The MCP payload is first-party, but that d...

The package contains concrete cryptocurrency transaction signing and transfer logic routed through a fixed gateway with hard-coded fee accounts. Although execution is command-triggered ra...

The npm postinstall hook writes karajan-mcp into Claude Code and Codex user configs without consent. That is unconsented mutation of a foreign AI-agent control surface, so the package is...

postinstall silently mutates the user's global Claude Code settings and turns on remote export of session prompts, replies, and tool traces. That is unconsented foreign agent-control-surf...

This package has no functional code but uses two unconsented automatic lifecycle hooks to exfiltrate host and CI information. The behavior is concrete install-time data collection and war...

This is concrete, unconsented install-time host data exfiltration with no corresponding package functionality. It is malicious install-hook abuse.

This package has no functional implementation but automatically exfiltrates host and CI-related metadata at install time. The behavior is concrete, unconsented, and unrelated to a legitim...

The automatic lifecycle hook mutates a foreign, broad AI-agent control surface and installs behavior-bearing commands. This meets the install-control-surface blocking policy despite the c...

This is concrete, unconsented install-time host-data exfiltration to a fixed external endpoint. The inert JavaScript file does not mitigate the lifecycle-hook behavior.

Automatic, silent transmission of globally captured application logs to an unrelated endpoint is concrete data exfiltration. The benign workspace-only postinstall hook does not mitigate t...

This is a concrete unconsented postinstall mutation of foreign AI-agent configuration and hooks through an opaque native executable. That meets the install-control-surface blocking policy...

The package contains an import-time detached remote-code execution chain unrelated to its advertised utility purpose. This is concrete malicious behavior even without an npm lifecycle hook.

This is concrete credential exfiltration and remotely controlled code execution on import. The Base64 endpoint encoding further conceals the behavior.

This package performs consequential SSH key, remote authorized_keys, local SSH configuration, dependency-installation, and background-process changes automatically during npm installation...

The package performs an automatic postinstall download or execution of opaque native code and immediately uses it to install Codex and Claude Code hooks. This is concrete install-hook abu...

This is concrete install-time agent-control mutation, not merely an optional CLI feature. The opaque native payload and remote binary download make the resulting hook behavior unreviewabl...