npm detections from LPM Firewall.

The package has a concrete automatic postinstall chain that changes user-wide Claude settings to capture and export session content. This meets the install-hook abuse policy for a malicio...

The sole install-time script is an explicit reverse-shell command with external output forwarding. This is concrete malicious behavior activated without user interaction beyond installation.

The install-time hook contains concrete remote-shell behavior, not a package-aligned setup action. This is malicious install-hook abuse.

The sole lifecycle script implements an install-time reverse shell and sends its output externally. This is concrete malicious behavior, not package setup.

This is unconsented postinstall mutation of a consumer project's AI-agent control surface and broader repository workflow. The guards are scoped to detected Suppa projects, but that does...

The package contains a concrete credential-redirection path to a fixed unofficial gateway and persists the credential. Lack of an install hook limits the trigger but does not remove the r...

The package performs automatic postinstall rewrites of foreign agent authentication and permission controls, then activates unrestricted operation through its launcher. This meets the ins...

The package automatically installs package-authored agent instructions into two unrelated default agent homes and modifies them on every install. This meets the install-time foreign/broad...

The package performs broad user-level AI-agent configuration and capability installation automatically from postinstall. This meets the install-control-surface blocking policy despite no...

This is an unconsented postinstall mutation of a broad foreign AI-agent control surface. The global command registration is persistent and applies beyond the installing project.

The automatic postinstall hook mutates Claude CLI configuration outside the package-owned directory. Under the install-control-surface policy, this is concrete malicious install-hook abus...

This is a concrete install-hook remote-code-execution chain: automatic postinstall downloads and executes shell scripts, then modifies the user's global tool and skill environment. The gu...

This is a concrete automatic install-time data-exfiltration chain with no corresponding package functionality. The suppressed-error preinstall hook runs reconnaissance commands and sends...

This is concrete, unconsented install-time system reconnaissance and data exfiltration with no legitimate runtime implementation. The package should be blocked.

The install hook directly patches foreign DSH authentication and sandbox-policy source rather than limiting itself to package-owned setup. This meets the install-time AI-agent control-sur...

This is an automatic install-time reconnaissance and data-exfiltration payload with no corresponding package functionality. The lifecycle hook suppresses failures while harvesting and tra...

The package performs unconsented install-time mutation of a broad AI-agent control surface by installing a separate global Claude Code package, alongside persistent shell and launcher cha...

The default remote endpoint, all-site extension access, and credential upload form a concrete credential-exfiltration path. The broad local AI credential discovery adds further sensitive-...

This is concrete concealed install-hook abuse, not a user-invoked setup flow. The lifecycle hook triggers process creation, persistent user-home changes, and SSH activity without consent.

This is concrete, unconsented install-time host profiling and exfiltration to an unrelated external endpoint. The automatic lifecycle trigger and identity-command collection make the pack...

This is an automatic install-time host and identity-data exfiltration path with no package functionality that requires it. The empty runtime module does not justify the lifecycle behavior.