@aziron/atlas@0.1.36

One or more suspicious static signals were detected.

npm install of @aziron/atlas@0.1.36

Unconsented postinstall mutation of an AI-agent control surface; the downloaded binary controls the exact writes.

remote native-binary download followed by automatic AI-assistant bootstrap

On installation, scripts/install.js fetches a platform archive, extracts the native atlas executable, and runs `atlas bootstrap`. The source explicitly says bootstrap automatically installs a skill and MCP configuration for AI assistants. Because this is an opaque downloaded binary run without user invocation during postinstall, its control-surface changes cannot be constrained by the package source.

This is concrete, unconsented postinstall execution that mutates AI-assistant configuration according to the installer's own comments. Documentation and opt-out controls do not remove the install-time control-surface risk.