@miracleplus/mplus@0.6.7

High-risk behavior combination matched malicious policy.

npm install

Unconsented mutation of AI-agent control surfaces; installed skills may influence later agent behavior.

recursive copy of bundled AI-agent resources during postinstall

Installing the package invokes postinstall without a user command. The hook recursively copies package-supplied skills into ~/.agents/skills and creates that directory if absent, affecting a broad agent skill-discovery surface. If present, it also writes agent-specific Claude/Codex locations. This is an unconsented install-time AI-agent control-surface mutation.

The lifecycle hook is concrete, unconditional for ~/.agents/skills, and modifies a broad foreign AI-agent discovery path. Under the install-control-surface policy, this requires a block regardless of the absence of network exfiltration.