npm detections from LPM Firewall.

This is unconsented postinstall mutation of a broad foreign AI-agent control surface. The absence of observed exfiltration does not neutralize the automatic cross-agent instruction deploy...

This is not transparent package-aligned setup: automatic installation creates a persistent launcher and ships obfuscated code containing AI-agent control instructions. The embedded agent-...

The package has a concrete postinstall chain that writes package-controlled content into many unrelated AI-agent skill directories. This meets the policy for malicious install-hook abuse.

The package performs opaque third-party dependency mutation and source-map deletion automatically at install time. Although no confirmed exfiltration endpoint was found in the inspected f...

The package performs unconsented, privileged system mutation from an automatic lifecycle hook and repeats it at CLI startup. This is concrete install-hook abuse despite no confirmed secre...

This is malicious under the install-control-surface policy because a postinstall hook automatically rewrites existing global Cursor and Codex agent configuration. The additional consumer-...

This is an automatic postinstall invocation of an opaque native binary to install AI-agent hooks, combined with unauthenticated executable download. It meets the install-control-surface b...

This package automatically installs an opaque native payload from an unauthenticated remote endpoint and later executes it. The absence of integrity verification makes the install hook a...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. It meets the install-control-surface blocking policy despite using a local stdio server.

This is an unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the blocking policy. The additional install-time authenticated request increases the...

The automatic install-time network fetch and forced replacement of shared executables are concrete, while the runtime embeds directives that control other AI agents' authentication and co...

The automatic postinstall hook mutates a foreign AI-agent control surface by globally installing Claude Code and persistently changes user startup and application files. This is concrete...

The automatic lifecycle hook modifies broad AI-agent configuration and promotes project permissions globally without obtaining consent through an explicit setup command. This is concrete...

This is malicious install-hook abuse: an automatic lifecycle hook broadly alters foreign OpenCode/project state and global tooling, while runtime code reinforces the package's upgrade and...

This package performs unconsented install-time and runtime host package installation, including sudo attempts, and automatically reuses third-party agent credentials. Those concrete behav...

The source establishes an automatic, hard-coded outbound upload path for potentially sensitive tool activity. Lack of an install hook limits the trigger to CLI use but does not remove the...

The package exports a cloud credential to a package-controlled endpoint. Although this is an explicit command rather than an install hook, the credential exfiltration is concrete and high...

The package automatically transfers environment-derived secrets to a fixed external default endpoint during GitHub Actions execution. The absence of an install hook reduces installation r...

This is concrete malicious install-hook abuse: an automatic lifecycle hook modifies consumer package-manager settings and broad AI-agent control surfaces while suppressing review and enco...

Source inspection confirms a bundled all-sites credential collector that uploads accepted login secrets to a remote default endpoint. This behavior is materially unrelated to the advertis...

Direct source inspection confirms automatic install-time system mutation and runtime disclosure of WhatsApp content to a hard-coded external Telegram recipient. These behaviors establish...