npm detections from LPM Firewall.

This is an unconsented install-time mutation of a broad AI-agent control surface. The automatic postinstall, disabled consent path, persistent global skill, hooks, and instruction changes...

The lifecycle hook performs broad, persistent Claude Code control-surface changes without user consent. This meets the install-hook abuse blocking policy even though the inspected path do...

The complete lifecycle path automatically and silently modifies global instruction files for three unrelated AI-agent tools, then injects directives that influence future sessions. This i...

The package contains a concrete automatic path that transfers workflow secrets to a fixed external service. Absence of an install hook does not remove the runtime credential-exfiltration...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic command execution. The existence checks limit targets but do not remove the in...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote executable delivery and privileged host configuration changes. The global-install gu...

The package covertly redirects Anthropic credentials to an unrelated remote service. No lifecycle hook is needed for this runtime credential-exfiltration behavior to warrant blocking.

The package has a concrete automatic postinstall path that modifies broad consumer AI-agent configuration and instruction files. This meets the install-hook abuse blocking policy even wit...

The package contains a concrete runtime path that extracts and transmits wallet private keys to a remote endpoint. This is credential exfiltration, not a necessary client-side transaction...

The source establishes a concrete credential flow to a fixed third-party host during runtime login recovery. Lack of an install hook does not mitigate the credential-exfiltration behavior.

The postinstall path unconditionally configures global Claude telemetry that captures AI-session content and directs it externally. This meets the install-time AI-agent control-surface ab...

The package has a registry-install postinstall hook that automatically changes multiple foreign AI-agent control surfaces and shell profiles. This meets the install-hook abuse boundary re...

The automatic lifecycle hook installs a bundled capability into global locations for many unrelated AI-agent products. Guard checks reduce accidental overwrite risk but do not establish u...

The source establishes an automatic postinstall chain that downloads and executes a binary which writes a skill into shared AI-agent directories. This meets the install-time foreign AI-ag...

The package performs persistent, external telemetry reporting with no opt-out, which is a concrete data-exfiltration surface. Although the schema excludes secrets and content, the hardcod...

The automatic postinstall hook mutates a foreign AI-agent control surface and installed dependencies, then can execute another install script with inherited environment variables. This is...

The automatic postinstall hook performs broad dependency replacement and removes debugging artifacts. That is concrete install-hook abuse, regardless of the absence of a confirmed externa...

The package contains a concrete remote-code-execution path: cloud-controlled values reach shell execution, and a relay-provided script is later run with bash. The absence of an install li...

This is a concrete recurring data-exfiltration path for sensitive agent activity and machine metadata. Although it is limited to paid plans and disclosed in source, the automatic collecti...

This is unconsented postinstall mutation of foreign AI-agent control surfaces and project skill metadata. The automatic lifecycle behavior is sufficient for a publish block even though no...

The automatic remote download, home-directory persistence, and dynamic execution form a complete remote payload chain. The inert install hook does not mitigate this runtime behavior.