npm detections from LPM Firewall.

Source establishes a concrete, automatic external data-exfiltration path for account metadata and broad console content. The benign workspace-only postinstall hook does not mitigate the r...

Source directly establishes runtime transmission of user account metadata to a non-mail-provider endpoint. The benign workspace-only postinstall hook does not mitigate this concrete data-...

The package performs unconsented install-time host reconnaissance and external transmission. Its canary description does not remove the concrete data-exfiltration behavior.

The package deliberately detects AI-agent and sandbox context and transmits it by default during normal CLI use. Although there is no lifecycle hook, this undisclosed collection is a conc...

The source directly implements credential collection and transfer to a non-GitHub service. The lack of an install hook limits the trigger but does not remove the credential-exfiltration b...

This package deliberately disables and programmatically approves Claude Code safety controls, including a write to its global configuration. The behavior is concrete, automatic for sessio...

The package has a concrete automatic postinstall path that replaces skills across three user-home AI-agent control surfaces. The opt-out does not establish consent for the default install...

Although no install-time hook runs, the published MCP tools expose an active chain for credential attempts, license forgery, and privileged remote modification of arbitrary caller-selecte...

The sole package source defines an automatic preinstall reverse shell, which is direct malicious install-hook behavior.

The automatic postinstall hook mutates Claude Desktop configuration and establishes future package execution. This meets the policy for malicious install-hook abuse even though the config...

The package contains a concrete automatic destructive action against consumer dependencies. No source evidence justifies this install-time deletion.

The package contains a concrete, automatic, destructive postinstall action against consumer dependencies. Its normal source does not justify that mutation.

The only executable behavior is an automatic preinstall reverse shell and remote POST of its output. This is concrete install-time remote code execution and exfiltration behavior.

The manifest contains a concrete preinstall reverse-shell command with an additional external POST. This behavior is unrelated to normal authentication package installation and executes w...

Source inspection confirms automatic upload of agent transcripts and credential metadata to server-directed endpoints during normal runtime. This is concrete data exfiltration behavior, n...

This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, reinforced by persistence-oriented package-manager changes and review suppression. No network thef...

This is concrete import-time remote code execution with a detached child process and self-removal behavior. The absence of an npm lifecycle hook does not mitigate execution through the co...

This is a concrete credential-exfiltration path: a password-bearing account object is serialized into a remote logging request. The lack of npm lifecycle hooks does not mitigate the runti...

The package contains an undisclosed runtime exfiltration path to a non-service host for broad console and account-sync telemetry. Although its postinstall hook is benign, the runtime data...

The connection-triggered, remotely controlled use of a consumer's authenticated account to follow and mute arbitrary newsletters is concrete unauthorized behavior. The lifecycle hook is b...

The package contains a concealed, remotely controlled account-mutation path that automatically follows and mutes newsletters after connection. This is concrete unauthorized behavior, not...