artefact-design-system@0.21.0

High-risk behavior combination matched malicious policy.

npm install of artefact-design-system as a dependency

Hijacks or steers AI-agent behavior in the consuming project.

postinstall writes consumer CLAUDE.md or AGENTS.md

The npm postinstall hook locates the consumer project via INIT_CWD or cwd and, when installed from node_modules, creates or appends a marked block in CLAUDE.md or AGENTS.md. That block directs AI agents to invoke this package’s CLI and follow its protocol. This is an unconsented install-time mutation of a foreign project’s agent-control surface.

Source inspection confirms a concrete postinstall write to consumer CLAUDE.md/AGENTS.md, which is a foreign AI-agent control surface. The absence of exfiltration does not mitigate this policy-blocking behavior.