@harness-memory/openclaw@0.2.1

One or more suspicious static signals were detected.

Installing the package when harnessmemory-bridge and harness-memory are available.

Unconsented replacement of the active OpenClaw memory extension during dependency installation.

postinstall invokes external setup that writes OpenClaw plugin configuration

On npm install, the postinstall probes for companion executables and, if present, runs `harness-memory openclaw setup`. The packaged setup implementation writes `~/.openclaw/openclaw.json` and assigns `plugins.slots.memory` to this plugin, potentially displacing another configured memory extension without an explicit setup command.

This is a concrete, unconsented install-time mutation of a foreign AI-agent control surface, even though the behavior is documented and conditional. No network exfiltration or concealed payload was found.