npm detections from LPM Firewall.

The default endpoint and Bearer authorization path establish concrete credential forwarding to a non-package-aligned host. This is sufficient for a publish block despite requiring an expl...

Automatic postinstall writes agent skills into the consuming project and can add remotely fetched skills. That is concrete unconsented mutation of a broad AI-agent control surface.

This is an unconsented install-time mutation of a foreign global AI-agent control surface. Integrity checks for the downloaded binary do not remove the risk created by automatic Cursor co...

The automatic lifecycle hook mutates foreign Claude Code and global Claude paths while installing unchecked remote artifacts. The runtime global self-update renews that install-hook path...

The package contains a complete server-driven remote shell execution path and an automatic forced self-update path with optional sudo. Its harmless install banners do not mitigate these r...

This is an unconsented install-time AI-agent control-surface action implemented through an opaque remotely fetched executable. Its automatic execution and fail-open verification create a...

This is concrete, automatic post-install mutation of a consumer project's broad AI-agent control surface, combined with persistent Git-hook execution. That meets the install-control-surfa...

The package has a concrete automatic postinstall path that modifies global AI-agent configuration and establishes future command execution. This meets the install-time AI-agent control-hi...

This is an automatic install-hook persistence chain with credential-accessing runtime behavior. The package mutates the user's agent execution environment and starts a long-running servic...

The install lifecycle automatically mutates foreign AI-agent hook surfaces, including Claude paths, through a nested package CLI invocation. The guards narrow when it occurs but do not pr...

The package performs automatic postinstall mutation of foreign, user-wide AI-agent settings and permissions. The lifecycle guard and lack of observed exfiltration do not remove the concre...

This package has a concrete install-time remote payload execution path. The same-origin checksum check does not constrain a compromised or substituted release response, so the automatic p...

The lifecycle hook establishes automatic persistence in a shared AI-agent directory and changes its configuration. Although no postinstall exfiltration was found, the concrete control-sur...

Source inspection confirms unconsented postinstall mutation of global Claude Code configuration and instructions. This meets the install-control-surface blocking policy even though no cre...

Source establishes credential collection and upload to a default endpoint inconsistent with the package's stated Happy identity. The explicit command trigger does not remove the misleadin...

This package combines concealed runtime logic with capture and hub-delivery primitives for sensitive LLM traffic. Although it has no install hook, the concrete data-exfiltration surface w...

The package creates concrete remote code execution and credential exposure paths when its user-facing commands run. Obfuscation and silent global self-updating further remove meaningful u...

The package performs broad, automatic, and persistent mutation of unrelated consumer-project source and build control files at install time. Although no install-time secret exfiltration w...

This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, including automatic command execution. The absence of demonstrated exfiltration does not neutra...

This is an automatically reachable remote-code-execution chain from the package's browser entrypoint. The lack of an install hook does not mitigate runtime execution of unpinned remote Ja...

The automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion e...