@krvinay/express_api@1.0.8

One or more suspicious static signals were detected.

npm install

Unconsented modification of a broad project AI-agent control surface and project configuration.

postinstall project scaffolding and AI-agent context injection

Installing the package executes install/index.js. It walks to the consumer project root, writes CLAUDE.md from the package, scaffolds files, and rewrites the consumer package.json main entry. A root CLAUDE.md can control Claude agent behavior for the whole project without an explicit user command.

The concrete postinstall mutation of a consuming project's root CLAUDE.md meets the foreign/broad AI-agent control-surface blocking policy. No exfiltration was found, but it is not needed for this lifecycle-based block.