devez-vibe@1.6.61

High-risk behavior combination matched malicious policy.

npm postinstall during package installation

A package installation changes AI-agent behavior and files without an explicit agent setup command.

automatic cross-agent global skill installation and pruning

The postinstall hook runs automatically, copies a bundled skill into both Codex and Claude global user directories, and prunes files there. This is unconsented install-time mutation of a broad, foreign AI-agent control surface. The bundled skill can subsequently influence agent workflows when available to those products.

Automatic postinstall injection into both global Codex and Claude skill directories is a concrete broad AI-agent control-surface mutation. The recursive pruning increases the persistence and replacement impact of that injection.