warden-ai@0.2.6

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm postinstall

Persists package-controlled tool access and behavioral instructions across installed AI agents and projects.

unconsented broad AI-agent MCP and instruction-file mutation

On npm installation, the postinstall hook silently invokes `warden init --skip-index`. That command writes MCP server entries into numerous global and project configurations, writes managed instruction blocks to third-party agent rule files, and modifies/compresses existing project instruction files. The injected rules instruct agents to route tool use and session behavior through Warden, establishing an unconsented cross-agent control surface.

This is concrete install-time mutation of broad, foreign AI-agent control surfaces without an explicit user command. The lack of detected exfiltration does not remove the persistence and control-hijack behavior.