npm detections from LPM Firewall.

The automatic lifecycle chain installs agent hooks and includes an unsafe Codex launch configuration. This is concrete AI-agent control-surface abuse, not merely a user-invoked CLI feature.

The executable's fixed remote default and credential POST conflict with the documented localhost default. This is concrete credential-exfiltration behavior, even though it is triggered by...

The package automatically changes a foreign consumer project and persists its own lifecycle execution. The behavior is concrete in source and exceeds a user-invoked setup tool or a narrow...

The package has a concrete automatic postinstall chain that writes agent skills into both Codex and Claude user homes and performs a user-level pip installation. This meets the install-ho...

The source implements a deliberate sandbox escape through launchd and is paired with an automatic install hook. Token gating limits exposure but does not neutralize the permission-bypass...

Source establishes a credential-exfiltration path from a supported API-key CLI option to default third-party telemetry. No install lifecycle hook is present, but that does not remove the...

This is concrete automatic install-hook abuse: it modifies a foreign consumer's package lifecycle and agent tooling, then retries changes after the installer exits. The absence of observe...

This is an unconsented install-time mutation of foreign AI-agent instruction directories. The lifecycle hook directly performs the change and suppresses errors, making it concrete install...

The automatic lifecycle hook downloads or executes an opaque native binary and invokes agent-hook installation without an explicit setup command. That is concrete unconsented postinstall...

The automatic lifecycle hook installs package-authored instructions into multiple foreign AI-agent directories and has a generic fallback. This meets the install-time AI-agent control-sur...

This is an automatic postinstall mutation of a foreign, broad AI-agent control surface. The conditional binary lookup does not establish user consent and the installer suppresses failures.

The postinstall hook performs broad AI-agent and shell configuration mutation automatically. Although no separate exfiltration endpoint was found, this concrete install-time control-surfa...

The automatic postinstall path mutates a broad, foreign AI-agent control surface. Safeguards against overwriting existing skill directories do not remove the unconsented installation beha...

This is a concrete automatic postinstall chain that broadly changes a consumer project's AI-agent configuration and enables an extra plugin. It meets the install-control-surface blocking...

The automatic postinstall hook writes a wildcard command into the consumer's Claude Code configuration. This meets the policy for malicious install-hook abuse even without proven secret t...

The package automatically and broadly alters a consumer project’s OpenCode agents, commands, skills, plugin files, and configuration. That meets the install-control-surface blocking polic...

The automatic postinstall hook mutates foreign AI-agent control surfaces in the consuming project and can overwrite an existing command. This is concrete unconsented install-time control-...

This is an automatic install-time remote-code-execution chain, not merely a user-invoked setup command. The external installer and Python payload are fetched and executed without integrit...

The source implements a covert persistent identifier and invisible response watermarking. Although it has no automatic npm lifecycle hook or confirmed exfiltration endpoint, the behavior...

The automatic global-install lifecycle mutates a broad AI-agent control surface and installs external plugin code. This meets the policy threshold for unconsented postinstall control-surf...

This is a concrete postinstall chain that executes an opaque native binary and modifies foreign AI-agent hooks and settings. It meets the install-control-surface block policy.