@godxjp/ui@18.14.0

High-risk behavior combination matched malicious policy.

npm installation runs postinstall in a consumer project.

A package installation can add an unrequested AI-agent tool channel and cause later execution of an external package.

Automatic write of a consumer MCP server configuration.

The package declares postinstall, resolves the consumer working directory, and writes a godx-ui server into .mcp.json if absent. That server invokes npx with @godxjp/ui-mcp, creating an unrequested agent extension channel outside the package's normal UI-library role. The skips and non-overwrite behavior reduce scope but do not establish consent for the install-time control-surface mutation.

Source inspection confirms an automatic postinstall write to the consumer's AI-agent MCP configuration that configures npx to run another package. This meets the policy for an unconsented install-time foreign AI-agent control-surface mutation.