npm detections from LPM Firewall.

The lifecycle hook performs persistent, cross-agent configuration changes and enables a command-executing MCP plugin without an explicit user command. This meets the install-hook abuse bl...

The package deliberately seeds an unauthenticated workspace with a fixed private HTTP OAuth authority and automatically uses it later. Although it is not install-time behavior, this is a...

Source inspection confirms credential forwarding to a fixed third-party endpoint on a reachable runtime path. The absence of install hooks does not remove the credential-exfiltration risk.

The automatic postinstall hook rewrites a foreign AI runtime in the consumer dependency tree. This is a concrete install-hook abuse even though the inspected code does not exfiltrate data.

The package combines default LLM body collection, Hub-decryptable outbound trace envelopes, and pervasive deliberate obfuscation. Although it has no install hook, the runtime data-exfiltr...

Source confirms default remote execution and transmission of the user's Zavudev API key to a separate hard-coded endpoint. There is no lifecycle hook, but the credential transfer is a con...

This is unconsented install-time mutation of a consumer project’s AI-agent control surface and package manifest. The lifecycle hook makes the behavior automatic and broad enough to requir...

The package performs unverified remote payload execution from an automatic lifecycle hook. This is a concrete install-time remote code execution path.

The concrete lifecycle chain mutates consumer package-manager settings and broad AI-agent control files, then suppresses review of those generated files. This meets the install-hook abuse...

The automatic lifecycle hook broadly mutates foreign AI-agent skill locations and executes another package’s global installer. The global-only guard does not establish consent for this cr...

The package has a concrete automatic lifecycle chain that writes and prunes skills in two unrelated agent configuration roots, then modifies the user Python environment. This meets the po...

This is an automatic lifecycle-based remote native payload installer that disables TLS verification and has no visible integrity validation. The later launcher execution completes a concr...

The automatic postinstall and startup paths perform unconsented host-level package installation, including sudo attempts. This is concrete install-hook abuse; credential discovery adds ma...

This is concrete unconsented postinstall mutation of a consumer project’s broad AI-agent control surfaces, coupled with review evasion and instructions to expose credentials. No automatic...

The source establishes automatic postinstall mutation of multiple unrelated AI-agent configuration surfaces, including default activation of a Codex plugin and MCP server. This is concret...

The package performs unconsented postinstall installation of executable plugins into a separate Herdr control surface and activates a background clipboard bridge. This meets the install-h...

This is an automatic lifecycle delivery path for an unverified remote native payload, with TLS verification explicitly disabled. The downloaded binary is subsequently executed by the pack...

The package has an automatic postinstall chain that mutates foreign AI-agent configuration and registers executable MCP tooling. The global-install guard does not provide explicit user co...

This is a concrete automatic lifecycle chain that executes an unverified native payload and installs hooks into foreign AI-agent environments. It meets the install-hook abuse publish-bloc...

This is unconsented postinstall mutation of a broad foreign AI-agent control surface. The absence of observed exfiltration does not neutralize the automatic cross-agent instruction deploy...

This is not transparent package-aligned setup: automatic installation creates a persistent launcher and ships obfuscated code containing AI-agent control instructions. The embedded agent-...