npm detections from LPM Firewall.

This is a concrete install-hook abuse chain: a dependency install automatically downloads and executes remote scripts and adds foreign AI tooling. The opt-out variables do not establish p...

The automatic lifecycle hook performs remote content retrieval and unconsented writes and deletions in multiple global AI-agent instruction directories. This is concrete install-hook abus...

The package has a concrete automatic postinstall chain that modifies multiple foreign AI-agent configurations and installs an enabled host hook. This meets the install-control-surface blo...

This is an automatic install-time mutation of a foreign AI-agent executable surface. The package supplies opaque native replacements, so the resulting code cannot be source-audited here.

This is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup est...

The package has a concrete automatic install-time path that weakens a foreign agent's permission and authentication controls. No exfiltration was needed to establish this install-hook abuse.

The package uses automatic lifecycle hooks to stage, execute, and erase a concealed remote payload. This is concrete malicious install-hook abuse.

This package has a concrete, unconsented postinstall path that modifies multiple foreign AI-agent instruction surfaces. The absence of network or shell behavior does not remove the contro...

The automatic postinstall fan-out mutates several home-directory AI-agent extension and configuration surfaces and may run a project upgrade. This concrete install-time behavior meets the...

The postinstall dry-run claim is contradicted by the helper’s unchecked default execution path. The package automatically launches a detached listener and alters user state during install...

The package automatically mutates a foreign AI-agent control surface during postinstall, which meets the install-control-surface blocking policy. Its runtime self-upgrade further makes th...

This is an automatic postinstall mutation of foreign project and machine AI-agent control surfaces, not an explicit setup command. The absence of demonstrated exfiltration does not neutra...

The package has a concrete automatic postinstall path that mutates multiple consumer-project AI-agent control surfaces. This meets the install-control-surface blocking rule despite the ab...

The automatic postinstall performs unconsented, multi-platform AI-agent control-surface mutation and can start a project migration. This meets the install-hook abuse blocking policy even...

This package contains concrete credential transfer and unsigned remote-script execution paths, not merely inert tooling. The npm lifecycle hook itself is not the primary issue, but the ru...

This package has a concrete automatic install-time chain that modifies a foreign agent's authentication controls. Its launcher additionally defaults the agent to unrestricted permissions,...

This is malicious under the install-control-surface policy: postinstall modifies all detected coding-agent configurations without user consent while installing a remote executable payload...

The automatic lifecycle hook mutates a foreign AI-agent control surface and deploys publisher-controlled remote content into the consumer workspace. This is a concrete unconsented install...

This is an unconsented postinstall mutation of a foreign AI-agent control surface in the consumer workspace. Its ownership and conflict checks do not remove the risk from creating that su...

The package’s postinstall behavior materially differs from its stated validation purpose and automatically launches a persistent service. Its local-only default does not make the unconsen...

The package contains a complete automatic remote-code acquisition and dynamic-execution path on normal CLI use. Integrity validation does not mitigate the unpinned trust in mutable regist...