npm detections from LPM Firewall.

The hard-coded trace collector and automatic runtime configuration create a concrete, unconsented data-exfiltration path. No lifecycle hook is needed for the harmful behavior to occur dur...

The package contains a concrete credential-exfiltration path activated during normal SDK transaction and quote operations. Lack of install hooks does not mitigate remote recovery of consu...

The package has an automatic lifecycle trigger and directly exfiltrates identifying host data to a fixed external endpoint. This is concrete malicious install-hook abuse, not package-alig...

The automatic postinstall hook performs a concrete, broad process-control action against running agent bridges. It does not need credential theft to create an unconsented install-time con...

This is a concrete remote-code-execution chain: remotely mutable web content reaches an unguarded bridge that executes host shell commands. The absence of an npm install hook does not mit...

The automatic lifecycle trigger, deliberate obfuscation, broad agent-skill replacement, and telemetry form a concrete malicious install-hook chain. The commerce functionality does not jus...

The package implements a concrete foreign-credential collection, remote bearer-token transmission, and cross-application credential persistence chain. No install hook is present, but the...

The package automatically persists a launcher in Claude Desktop configuration during postinstall. This meets the policy for malicious install-hook abuse regardless of the Warp-branded API...

This is an unconsented postinstall mutation of a broad AI-agent control surface. The source makes the persistence automatic rather than requiring an explicit setup command.

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. The package suppresses installation failures and deliberately bypasses interactive consent.

Source directly connects token-bearing command options to a default external telemetry capture path. The absence of npm lifecycle hooks does not mitigate this runtime credential disclosure.

The package contains automatic, hard-coded exfiltration of user-controlled agent tool data to an unrelated remote logging service. Limited pattern redaction does not remove the concrete p...

This is an unconsented install-time mutation of a broad AI-agent control surface, which meets the blocking policy. The explicit feedback endpoint is not the basis for the verdict.

This is a concrete automatic postinstall chain that broadly mutates a foreign AI-agent control surface and adds persistent package-controlled hooks and instructions. The absence of proven...

This is an unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle path is explicit and directly creates global hooks and global instruction files.

The fixed xAI TTS request forwards the active runtime credential without ensuring it is an xAI credential. This is concrete credential exfiltration reachable from the package CLI.

This is a concrete automatic postinstall control-surface mutation, which meets the blocking policy. No network exfiltration was needed to establish the install-hook abuse.

This is unconsented postinstall mutation of a broad AI-agent control surface. The package's lifecycle hook establishes persistent future command execution and global agent instructions.

The automatic global OpenCode control-surface write is concrete and is coupled to package-supplied agents with privileged capabilities. Integrity checking of one downloaded binary does no...

The package performs unconsented postinstall mutation of a broad AI-agent control surface and registers persistent future-session commands. This meets the install-hook abuse blocking poli...

This is unconsented postinstall mutation of a broad, foreign AI-agent control surface. The package establishes persistent commands and global instructions, so it meets the blocking instal...