npm detections from LPM Firewall.

Source inspection confirms a lifecycle-triggered CLI launch and a runtime path that forwards a local credential to a fixed proxy while modifying Claude Code gateway configuration. These b...

The automatic lifecycle script mutates broad AI-agent and repository control surfaces in a consumer project. This meets the install-hook abuse blocking policy despite no observed exfiltra...

The source directly collects GitHub credentials and posts them as bearer authentication to a hard-coded external endpoint. This is concrete credential exfiltration, regardless of the pack...

The package performs an unconsented postinstall mutation of a foreign, broadly available AI-agent control surface. The absence of credential theft does not neutralize that concrete instal...

The automatic postinstall mutates foreign AI-agent control surfaces and adds persistence through Git hooks. This is concrete install-hook abuse even though no automatic network exfiltrati...

The package covertly injects third-party newsletter metadata into every prepared image and video message. The benign Node-version preinstall check does not mitigate this runtime content m...

This is concrete unconsented postinstall mutation of multiple foreign AI-agent configuration surfaces, coupled to package-controlled command execution and dependency patching. Safeguards...

This is an automatic lifecycle-driven remote code execution chain with broad machine mutation. Checksum verification of artifacts does not protect the separately piped remote script or pi...

The automatic lifecycle hook establishes a concrete AI-agent control-surface mutation chain through an opaque native binary. This meets the install-hook abuse blocking policy even though...

This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces. Checksum verification reduces tampering risk for the downloaded binary but does not establish conse...

The package performs an unconsented postinstall global installation of another AI-agent CLI. That concrete lifecycle mutation warrants blocking even though no credential theft was found i...

The documented default and executable default conflict, while the executable directly posts prompted credentials to the undisclosed fixed host. This is concrete credential collection rath...

This is an unconsented postinstall mutation of a consumer project's broad AI-agent control surface. The safeguards against clobbering do not remove the automatic control-surface write.

The package performs automatic postinstall mutation of both Claude Code and Codex global MCP configuration. This meets the install-control-surface blocking policy even though the inspecte...

The package has a concrete automatic postinstall chain that rewrites Claude Code and Codex configuration to execute its MCP server. This meets the install-hook abuse blocking policy regar...

The automatic lifecycle hook executes opaque remote code from a mutable branch, creating a concrete remote-code-execution supply-chain path. Skip guards do not protect normal global insta...

The automatic postinstall invokes an opaque native binary to modify Codex and Claude Code hooks. That is a concrete unconsented install-time AI-agent control-surface mutation.

The package directly harvests an available GitHub credential and transmits it to an opaque external endpoint. The absence of an install hook does not mitigate credential exfiltration when...

This is an unconsented postinstall mutation of a broad consumer AI-agent control surface. The installed hooks actively inject policy into agent sessions, which meets the blocking policy e...

This is an unconsented postinstall mutation of a broad global AI-agent control surface. Exclusive creation avoids overwrites but does not remove the risk of first-install persistence.

The source establishes a direct credential transmission to a fixed external gateway. Although it is runtime-triggered rather than install-time, this is concrete credential-exfiltration be...