@lark-codem/codem-core-darwin-x64@0.7.67

High-risk behavior combination matched malicious policy.

npm postinstall

May lower macOS metadata protections for the bundled executable, but no payload execution, exfiltration, persistence, or external control-surface mutation is established.

chmod plus xattr deletion on package-local codem-core

The scanner’s lifecycle finding is real but package-aligned: it only prepares the bundled Darwin binary and removes xattrs from that same file. Direct inspection found no concrete malicious chain or unconsented foreign AI-agent control-surface mutation.