npm detections from LPM Firewall.

This is a concrete credential-harvesting payload automatically deployed into an auto-loaded agent skill path. The benign native-module rebuild postinstall hook does not neutralize the run...

The automatic lifecycle hook performs broad, destructive agent-configuration changes and activates a plugin across existing tools. This meets the install-hook abuse block policy despite n...

The package contains a concrete runtime path that defaults to third-party webhooks and posts rich application records. Although it has no install hook, the embedded destination and automa...

This package performs unconsented, automatic host-level package installation and destructive dependency mutation during postinstall. The behavior is concrete install-hook abuse even thoug...

The package contains a concrete default library path that transmits an API credential to an external remote execution service. The absence of install hooks and the safer CLI default do no...

Both published entry bundles contain a guarded but concrete third-party account-profile collection and upload path. The absence of an install hook does not neutralize this runtime data-ex...

The package embeds active third-party webhook endpoints as the default destination for rich runtime logs and transmits the serialized records automatically. This is concrete unconsented d...

The postinstall hook automatically overwrites global Pi agent instructions and creates user-wide files. This meets the install-hook abuse policy even though no network exfiltration was fo...

Source inspection confirms an automatic postinstall that writes a wildcard Claude Code hook into the consuming project. This meets the policy threshold for malicious install-hook abuse re...

The source implements a deliberate, reachable macOS sandbox escape through launchd. Its local postinstall notification does not remove the concrete runtime bypass.

The global postinstall path automatically modifies multiple AI-agent instruction surfaces and enables Codex network access. The remote-authority instruction makes the resulting control pa...

This is a remotely controlled, broad destructive operation disguised as cache cleanup. Its explicit invocation requirement reduces automatic exposure but does not make the behavior safe o...

The package has a concrete automatic postinstall chain that modifies foreign AI-agent configuration and installs command-controlling hooks. This meets the install-control-surface blocking...

The automatic lifecycle hook broadly mutates foreign AI-agent control surfaces and replaces existing extension content. This meets the install-control-surface blocking rule despite the av...

The package performs automatic postinstall execution of an opaque native binary specifically to install hooks for multiple AI agents. This is a concrete unconsented AI-agent control-surfa...

The automatic postinstall chain writes behavior-bearing configuration into Claude and Codex homes and registers command hooks. This meets the install-hook abuse policy even though no auto...

The implementation's unrestricted recursive deletion contradicts its cache-cleanup description. The remote authorization gate adds covert control over a destructive payload.

The package explicitly reads locally available GitHub credentials and sends them to a hard-coded external endpoint. The lack of an install hook limits the trigger but does not remove the...

The postinstall hook automatically mutates a browser agent-control surface by registering native hosts and launchers. This meets the install-time control-surface blocking policy despite t...

The package has no install lifecycle hook, but its normal CLI runtime collects GitHub credentials and forwards them to an external default endpoint. That concrete credential-exfiltration...

The package forwards usable GitHub credentials to a remote service under its control and couples this with automatic telemetry and self-updating behavior. Although it lacks install hooks,...