starling-ai@0.1.8

High-risk behavior combination matched malicious policy.

npm install of starling-ai@0.1.8

Persistent changes to future Codex/Claude agent behavior without a separate user-invoked setup command

install-time AI-agent skill and hook installation

Installing the npm package triggers postinstall, which writes package-supplied Starling skill instructions into Codex and Claude skill directories and updates Claude settings hooks for events such as UserPromptSubmit, PreToolUse, PermissionRequest, and SessionEnd. Those hooks invoke the local Starling CLI on future agent events, creating persistent AI-agent control-surface changes as an install side effect.

Static source inspection confirms unconsented lifecycle mutation of Codex/Claude agent skill and hook configuration, which is a concrete publish-block condition even though the CLI behavior itself appears package-aligned. No exfiltration or credential theft was found, so the verdict rests on install-time AI-agent control-surface mutation. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.