izanagi-ai@2.0.6

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

npm postinstall

Unconsented persistence and control of project AI-agent behavior.

recursive copy of AI-agent instructions into INIT_CWD/.agents

Installing the package runs its postinstall hook. The hook loads the installer, which resolves the consumer project via INIT_CWD or cwd and recursively copies framework files into the generic .agents control surface, including AGENTS.md, SYSTEM.md, and RULES.md. Existing destination files are overwritten without an opt-in command or consent check.

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. Absence of exfiltration does not remove the persistent prompt/control hijack risk.