npm detections from LPM Firewall.

The automatic postinstall modifies the consumer project's OpenCode configuration and installs enabled npx-based MCP commands. This meets the install-time AI-agent control-surface abuse bo...

This is a concrete import-time remote code execution mechanism, not ordinary validation functionality. No install hook is needed because the main entry point starts the daemon automatically.

The package has a concrete automatic postinstall path that mutates several unrelated user-level AI-agent control surfaces. No self-dependency or exfiltration was needed to establish insta...

The automatic postinstall performs unconsented global Claude Code installation and persistent user-level configuration changes. This is a concrete install-hook abuse chain affecting a for...

This is concrete AI-agent control hijacking and provider impersonation, not ordinary gateway behavior. The absence of an install lifecycle hook does not remove the runtime attack path.

The package contains a concrete postinstall path that alters several third-party AI-agent skill directories and installs instructions that influence later agent actions. This meets the po...

This is a complete unconsented postinstall chain that mutates a consumer AI import path and transmits intercepted LLM content remotely. The behavior meets the install-hook abuse policy fo...

This is a concrete install-hook abuse chain: automatic lifecycle execution obtains and runs remote code, globally installs software, and persists fetched content. The isolated shared-agen...

The install hook automatically and silently modifies both Claude and Codex global configuration, registering executable package code. This meets the blocking policy for unconsented lifecy...

The automatic lifecycle hook mutates foreign, broad AI-agent configuration files and installs a package-controlled MCP server without consent. This meets the install-control-surface block...

The package covertly transmits sensitive user input and authentication-related exam state, and obscures related runtime code. Its prepare-only hook does not reduce the confirmed runtime d...

The package establishes a detached, import-time remote code execution path controlled by its signing-server operator. Its scanner-directed claim that signatures eliminate malware risk fur...

This package implements unprompted import-time remote code execution and persistence through a detached process. Signature verification does not remove the remote operator's ability to de...

The automatic postinstall chain modifies another package's launcher and renderer, then makes the modification self-healing and persistent across normal launches. This meets the install-ho...

The package performs unconsented postinstall mutation of global Pi-agent settings and global Maestro workflow locations. No exfiltration was found in the inspected installer scripts, but...

The automatic postinstall hook performs broad, unconsented mutation of foreign AI-agent configuration surfaces. This meets the install-control-surface block policy even though no credenti...

The automatic lifecycle hook writes package-authored agent definitions into a consumer or home AI-agent directory. This meets the blocking policy for unconsented postinstall mutation of a...

OpenSSF Malicious Packages via OSV confirms server-authorized-cleanup@1.1.0 as malicious (MAL-2026-16079): Malicious code in server-authorized-cleanup (npm)

OpenSSF Malicious Packages via OSV confirms external_deps_enjoyer@1.0.0 as malicious (MAL-2026-16076): Malicious code in external_deps_enjoyer (npm)

OpenSSF Malicious Packages via OSV confirms kiki-baileys@1.0.0 as malicious (MAL-2026-16033): Malicious code in kiki-baileys (npm)

OpenSSF Malicious Packages via OSV confirms service-home@0.0.1 as malicious (MAL-2026-16039): Malicious code in service-home (npm)