devez-vibe@1.6.56

High-risk behavior combination matched malicious policy.

npm postinstall

The package establishes persistent influence over two AI-agent control surfaces and can replace or remove files in its target skill directories on installation.

Recursive copy and pruning of a skill into foreign agent configuration directories

On installation, the postinstall hook runs a script that copies the bundled luna-loop skill into both the user's Codex and Claude skill directories. The script then prunes destination entries not present in the package, so it maintains those external agent-control directories. Although the installed skill says its later use requires an explicit invocation, the initial placement and synchronization are automatic and affect two foreign agent environments.

The package uses an automatic npm lifecycle hook to write and prune skills in both Codex and Claude user directories. This is unconsented postinstall mutation of a broad AI-agent control surface, which meets the blocking policy.