@keemgunn/lanesmith@1.4.0

One or more suspicious static signals were detected.

npm installation, through the postinstall lifecycle hook.

The package can add or replace prompts that influence installed AI-agent tools and modifies global Lanesmith configuration.

Automatic replacement and copying of packaged agent skills into shared home-directory agent control surfaces.

On npm installation, postinstall launches a bootstrapper that uses the user's home directory. It removes Lanesmith-named directories and writes packaged skills into both ~/.agents/skills and ~/.claude/skills, shared control surfaces for AI agents. It also refreshes global Lanesmith settings. These mutations happen automatically, before the user invokes the CLI, so the package can alter agent behavior without consent.

The package has a concrete, automatic postinstall path that mutates third-party AI-agent control surfaces in the user's home directory. Although no credential theft or network exfiltration was found, this unconsented lifecycle behavior meets the install-control-surface blocking policy.