@inizioevoke/astro-core@3.0.3

High-risk behavior combination matched malicious policy.

npm installation executes the postinstall lifecycle hook.

Unconsented persistent AI-agent behavior can be introduced or replaced in the consumer project.

postinstall recursive delete-and-copy into a foreign `.claude/skills` directory

On npm install, the lifecycle hook ascends to the consumer project root, removes `.claude/skills/evoke-astro-core`, and copies in the package's Claude skill. This silently establishes and persists package-controlled agent instructions outside the package directory, without an explicit user command or consent.

This is an unconsented postinstall mutation of a foreign AI-agent control surface and includes recursive replacement of its destination. No exfiltration is needed for this concrete control-surface compromise.