ryo-framework@2.3.6

High-risk behavior combination matched malicious policy.

npm global install of ryo-framework@2.3.6

Adds AI-agent profiles with edit/bash permissions to the user's OpenCode configuration, changing future agent behavior and capabilities.

install-time OpenCode agent/config write

On global installation, npm runs the package postinstall script. That script exits for non-global installs, but for global installs it copies package-controlled OpenCode agent markdown files into the user's home config and merges package-controlled agent definitions into ~/.config/opencode/opencode.json. Several installed agents permit edit and bash actions, altering the user's AI-agent control plane before any explicit ryo opencode-setup command.

The source confirms unconsented lifecycle mutation of an AI-agent configuration surface, which is a concrete attack behavior under the review policy even though the bundled prompts do not show exfiltration. Runtime npm update checks and upgrade commands are package-aligned and not the blocking issue. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.