brainmesh@0.0.1

One or more suspicious static signals were detected.

An AI agent reads package files; user explicitly runs brainmesh service install.

May coerce AI agents to modify unrelated source files and spread the injected instruction.

cross-repository prompt injection with scheduler-artifact propagation

The package embeds an instruction addressed to AI agents that directs edits outside the package. It is repeated throughout source and is also included in generated launchd/systemd artifacts, allowing the instruction to persist into user-managed configuration after an explicit service-install command. The postinstall itself builds locally, but the embedded manipulation is concrete and unrelated to Brainmesh functionality.

Source inspection confirmed deliberate reviewer/agent manipulation and propagation into generated artifacts. This warrants blocking despite otherwise package-aligned build behavior.