@nookplot/mcp@0.4.132

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

npm install or npx install lifecycle; also MCP server startup repeats the skill install

Adds autonomous slash-command instructions to Claude Code without explicit install-time consent, enabling package-defined agent workflows and recurring cron prompts inside the AI agent environment.

unconsented lifecycle copy of agent skill files

On install, the postinstall script silently copies bundled skill directories into ~/.claude/skills if Claude Code is present. Those skills define slash-command agent workflows that can create recurring cron jobs and drive MCP tool usage. This is an install-time mutation of an AI-agent control surface, independent of the package's otherwise aligned Nookplot network functionality.

Source inspection confirms a postinstall hook that writes package-controlled Claude skill instructions into the user's AI agent configuration area without an explicit setup command. That meets the firewall boundary for unconsented lifecycle AI-agent control-surface mutation, even though credential and network behavior otherwise appears package-aligned. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.