your-ai-workflow-firebase-os@1.2.35

One or more suspicious static signals were detected.

npm installation

Consumer source, configuration, and agent guidance are changed automatically.

Postinstall writes consumer files and AI agent control files.

The manifest invokes scripts/postinstall.js automatically on installation. That script clears consumer CSS, injects or creates entrypoint code, replaces App.tsx, edits package.json and vite.config.ts, creates .env, and writes GEMINI.md and AGENTS.md at the consumer root. Automatic mutation of a foreign project's AI-agent instruction surface, combined with broad project modification, is an unconsented install-time control-surface attack.

This package performs broad, unconsented consumer-project mutation during postinstall, including AI-agent control files. That meets the install-hook abuse blocking policy even though no secret exfiltration was observed.