npm detections from LPM Firewall.

The package creates a concrete, automatic data-exfiltration path for full agent transcripts and includes a remote-code execution update path. These behaviors are not install hooks, but th...

The package's automatic postinstall writes and configures broad consumer AI-agent and Git control surfaces, including a hook that can block agent completion. This meets the install-time A...

The package performs unconsented install-time remote code execution and mutates a foreign AI-tool installation outside its own package directory. The interactive coding-agent wizard is gu...

This is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, including a remote latest npx MCP command. The guard against global installs does not limi...

Source directly establishes silent transmission of serialized account configuration, including a defined password field, to a fixed external host. This is concrete credential exfiltration...

The package automatically persists itself into Claude Desktop through a postinstall hook, which meets the install-control-surface blocking policy. The resulting MCP process reads a local...

The package implements a default route that sends OAuth authorization material and refresh tokens to a package-controlled external host. This is a concrete credential-exfiltration surface...

The automatic lifecycle hook combines unauthenticated remote content retrieval with writes to broad, foreign AI-agent instruction directories. This is concrete unconsented agent control-s...

The package automatically executes a mutable remote native payload during postinstall and delegates broad system and agent-tool setup to it. This is concrete install-hook abuse despite th...

The automatic lifecycle hook performs broad consumer-project agent and Git control-surface mutation. Its resolution guard does not establish user consent for those changes.

This is an unconsented postinstall mutation of a consumer project's broad AI-agent control surface. Guards limiting the target project do not remove the automatic hook and skill injection.

The automatic lifecycle hook retrieves remote content and places agent instructions into several foreign global control directories. This satisfies the install-time AI-agent control-surfa...

This is concrete unconsented postinstall mutation of a consumer AI-agent control surface, combined with remote thin-mode code/content deployment. The preservation of an existing configura...

The package performs a concrete, automatic postinstall write to a user-wide agent extension location and the installed code modifies agent control inputs. This meets the install-control-s...

The automatic postinstall hook writes a foreign Claude Desktop MCP configuration and registers this package as a tool without a user command. That meets the install-control-surface blocki...

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The conditional binary check does not make the automatic global hook installation safe.

The package intentionally captures and transmits reusable Codex credentials to a third-party default endpoint. No install hook runs automatically, but the user-invoked flow is still concr...

Source directly establishes credential collection and transmission to a third-party default endpoint. The lack of an install hook does not remove the credential-exfiltration behavior.

The package performs automatic, persistent, broad AI-agent and consumer-project mutations from postinstall. This meets the blocking policy for unconsented lifecycle mutation of a foreign...

Automatic lifecycle execution bypasses consent in non-interactive contexts and launches a concealed helper that builds and persists a background service outside the package. This is concr...

The claimed dry-run behavior contradicts the helper's actual default control flow. Automatic creation of a detached service and home-directory state during installation is concrete instal...