npm detections from LPM Firewall.

The package deliberately routes npm credentials and uploaded content through an opaque third-party endpoint. This is concrete credential and data exfiltration behavior despite requiring a...

The custom Worker receives both the npm bearer token and package payload during normal browser publishing, while an embedded credential increases immediate exposure. This is concrete cred...

The package implements a credential-harvesting proxy for npm publishing, with an embedded npm token as an additional severe indicator. User interaction is required, but the credential tra...

This is concrete credential and data exfiltration through a third-party endpoint during the advertised publishing flow. The absence of an install hook does not neutralize the user-trigger...

The third-party endpoint receives an npm bearer token and user-selected package contents under misleading registry-publishing status text. This is concrete credential and data exfiltratio...

The explicit click does not neutralize the embedded credential or the non-npm proxy receiving both the bearer token and upload data. This is concrete credential and data exfiltration beha...

The code intentionally routes npm credentials and upload data to an unrelated Worker in its normal browser path. This is concrete credential and data exfiltration, not a package-aligned d...

Source directly establishes transmission of an npm bearer token and selected file payload to a non-npm endpoint under the package author's control. The hardcoded npm-style token further s...

This is an unconsented postinstall mutation of broad, pre-existing AI-agent control surfaces. The conditional checks and opt-outs do not establish user consent.

Direct inspection confirms an automatic preinstall hook that fingerprints the host and exfiltrates the values over HTTP. This is concrete malicious install-hook abuse.

This is concrete, unconsented runtime data exfiltration from an AI coding agent to a package-controlled endpoint. No lifecycle hook is needed because the exposed CLI directly activates th...

The package performs an automatic postinstall chain that alters consumer configuration and installs package-controlled AI-agent instructions and skills. Its generated instruction explicit...

This is a concrete automatic remote-code-execution chain during installation, with an opaque native payload fetched from a mutable latest-release endpoint. The source also persists the pa...

This package has a concrete automatic postinstall chain that modifies and deletes files in a user's Claude Code configuration. The global-install trigger does not require a separate expli...

The package performs unconsented install-time system mutation and later automatic command execution and external control-surface writes. The absence of observed secret theft does not remo...

The package contains a concrete, exposed phone-number exfiltration path to an unrelated host with an abusive custom header. Its benign version-check preinstall hook does not mitigate that...

This is an automatic lifecycle remote-code delivery chain, not a transparent package-only CLI installation. The downloaded payload is not independently pinned or reviewable, and the packa...

This is unconsented postinstall mutation of a foreign AI-agent control surface, combined with broad deletion in the user's Claude command directory. The automatic native download further...

This is an automatic remote-native-payload bootstrap whose trust decision is controlled by the payload source itself, followed by execution of the resulting binaries. That install-to-exec...

The postinstall hook mutates a foreign global agent control surface and installs an auto-starting background plugin. This is concrete unconsented install-hook abuse, even though no instal...

The package performs unconsented install-time mutation of foreign dependency code and removes source maps afterward. This is a concrete install-hook abuse pattern even though the hook its...