npm detections from LPM Firewall.

The package's automatic lifecycle hook persistently installs a wildcard Claude Code command hook in the consumer project. This meets the policy threshold for malicious install-hook abuse.

The package contains no automatic npm install hook, but its user-invoked authentication flow deliberately delegates Google credential collection to an unrelated GitLab Pages domain. This...

The automatic lifecycle hook broadly mutates foreign AI-agent control surfaces and registers package-owned command callbacks. This meets the install-hook abuse blocking policy despite no...

The install hook mutates broad, foreign AI-agent control surfaces and accepts remotely fetched instruction content. This is concrete unconsented install-hook abuse.

This is an unconsented postinstall path that downloads and executes opaque code to register across available agent harnesses and start a background process. Checksum verification limits r...

The automatic postinstall performs a concrete, in-place mutation of a foreign AI-agent host package. Anchor checks and backups do not establish consent for that lifecycle-time control-sur...

The source establishes automatic runtime collection and transmission of user repository metadata to an undisclosed private endpoint. The absence of an npm lifecycle hook limits the trigge...

The source establishes a complete automatic postinstall chain that overwrites executables owned by @openai/codex. Backup and hash checks do not mitigate the unconsented replacement of the...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, combined with automatic user-wide dependency installation. That satisfies the install-control-surf...

This is unconsented install-time host mutation with automatic privileged package-manager execution, and it persists as a retrying runtime behavior. It is not required for ordinary depende...

The fixed gateway receives a caller’s API credential at runtime, which is not necessary for a local investment utility and creates a concrete credential-exfiltration path. The package als...

This is unconsented postinstall mutation of a broad third-party AI-agent control surface. The automatic hook registration establishes persistent execution, so it meets the publish-block p...

This package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating...

The automatic lifecycle hook forcibly changes project-level Claude behavior, which is concrete install-hook abuse under the policy. No separate exfiltration is required for this blocking...

The automatic postinstall hook writes to user-wide OpenCode configuration and enables this plugin without an explicit setup action. That matches the policy's publish-block condition for u...

This is a concrete install-time remote-code-execution backdoor, not functionality required by the stated n8n health-monitor node. The listener is exposed on all interfaces and has no auth...

The source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP us...

The package combines automatic host package installation with recurring lifecycle-enabled global self-updates and third-party agent-hook rewriting. These actions occur without an explicit...

Source directly establishes a fixed remote credential destination and persistent session handling. The explicit command trigger does not remove the credential-exfiltration risk of the unv...

This is an automatic install-time remote native payload chain with TLS verification explicitly disabled. The same hook replaces agent-related filesystem paths with content from that unver...

The package combines automatic installation-time mutation of a consumer project with broad AI-agent control-surface writes and an instruction that suppresses review of those writes. This...