npm detections from LPM Firewall.

The package contains concrete default-on outbound collection of organization identity and runtime event data to a package-controlled endpoint. Although it has an opt-out and no install ho...

This is an unconsented postinstall mutation of a broad, foreign AI-agent control surface, combined with downloaded executable code and unsafe default permissions. The behavior is concrete...

The source establishes a default outbound telemetry path that receives all init arguments, including a credential-bearing option. This is concrete credential exfiltration during normal CL...

The automatic lifecycle hook deletes and replaces third-party agent skill directories, then installs a skill with automatic global package installation behavior. This meets the install-ti...

OpenSSF Malicious Packages via OSV confirms ultra-ws@1.0.0 as malicious (MAL-2026-16155): Malicious code in ultra-ws (npm)

This is a concrete import-time remote-code-execution backdoor with detached-process persistence. The absence of an install hook does not reduce the risk to consumers that import the decla...

The automatic postinstall hook modifies third-party dependency code and then strips debugging artifacts. That combination is a concrete, opaque install-hook abuse even though no install-t...

This is concealed remote-controlled account mutation in the default runtime path, not a requested library feature. The benign Node-version preinstall check does not mitigate it.

The automatic, remotely controlled modification of a user's WhatsApp newsletter subscriptions is concrete malicious behavior. The benign Node-version preinstall check does not mitigate th...

This is concrete, automatic data exfiltration on import, not package-aligned functionality. The absence of an install hook does not mitigate the import-time behavior.

This is concrete, unconsented postinstall mutation of a foreign AI-agent host and its user-level skill catalog. Backup and anchor checks limit breakage but do not remove the control-surfa...

This package automatically exfiltrates an environment credential in a preinstall hook, while its stated validation does not enforce a result. The icon runtime code appears benign, but it...

This is an unconsented install-time supply-chain path that fetches mutable remote code and mutates a separate Python environment. It is concrete install-hook abuse, not ordinary package-l...

The package uses an automatic install hook to socially engineer an AI agent into a follow-on setup flow that persists commands and instructions in global agent configuration. This is a co...

This is an unconsented postinstall path into an opaque native installer that carries assistant-skill installation content. It meets the policy for malicious install-hook abuse of a broad...

The automatic postinstall hook persistently mutates a foreign, broad AI-agent instruction surface. This meets the install-control-surface blocking policy regardless of the otherwise packa...

This is an unconsented install-time mutation of a foreign, user-global AI-agent control surface. Under the stated policy, that concrete behavior requires blocking publication.

The automatic lifecycle hook deploys remote, mutable code and changes a user-level Python environment without artifact verification. This is a concrete install-time supply-chain attack su...

The lifecycle hook performs unverified remote payload retrieval and broad user-environment package installation automatically. These actions create a concrete install-time code-execution...

This is an automatic remote payload execution chain with no checksum or signature verification, compounded by quarantine removal. Although the host is package-aligned and no direct secret...

The automatic install hook deletes external user binaries and performs persistent machine tracking with remote transmission. This is concrete destructive behavior and data exfiltration un...