gm-plugkit@2.0.2575

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

User runs the gm-plugkit CLI or calls ensureReady().

Can persist package-controlled instructions across Claude/agent projects and route subsequent agent actions through an opaque downloaded runner.

AI-agent instruction injection plus verified remote binary download and daemon execution

On an explicit CLI run, ensureReady creates or modifies project AI-agent instruction files and copies package-controlled skills into both ~/.agents and ~/.claude. It downloads a SHA-checked native runner, executes it detached as a spool daemon, and the installed skill instructs agents to dispatch work through that daemon. The hashes verify transport integrity but do not make the opaque remote executable or broad agent-control writes safe.

This is a concrete broad AI-agent control-surface takeover chain, not merely a bootstrapper: it modifies home and project instruction files and executes a remotely obtained native daemon. Absence of an npm lifecycle hook reduces automatic-install risk but does not remove the malicious capability and persistence created by normal invocation.