domma-js@0.29.3

High-risk behavior combination matched malicious policy.

npm install lifecycle postinstall

Mutates Claude Code control/instruction files in the consuming project at install time.

default-yes prompt copies package-supplied AI assistance files

On install, package.json runs bin/postinstall.js. If installed under node_modules outside CI, it locates the consumer project root and asks whether to copy AI assistance files; any response other than explicit n/no, including empty default input, proceeds. It then writes CLAUDE.md, .claude/, blueprints/, and types/ from package templates into the project, changing AI-agent instruction/control surface during installation.

Even though the copied instructions look package-aligned, install-time default-yes mutation of CLAUDE.md/.claude is a concrete unconsented AI-agent control-surface write. No exfiltration was found, but this behavior meets the firewall block boundary for lifecycle AI-agent control hijack. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.