npm AI-agent policy reports, with evidence.

The automatic hook modifies foreign AI-agent rule directories and deletes existing configuration, which meets the install-control-surface blocking policy. Its automatic remote native-bina...

The package has a concrete automatic install-time path that mutates multiple external AI-agent instruction surfaces. This meets the blocking policy for unconsented post-install control-su...

The package performs unconsented post-install mutation of multiple consumer AI-agent control surfaces. This meets the blocking policy for lifecycle-based control-surface modification.

Automatic installation-time rewriting disables a third-party agent's sandboxing, then the launcher activates and persists the unsafe permission default. This is a concrete AI-agent contro...

The package has an unconsented postinstall path that mutates a foreign, broad AI-agent control surface and installs a future execution command. This meets the install-control-surface bloc...

This is an unconsented postinstall mutation of a broad AI-agent control surface that enables external collection of Claude session content. The opt-out environment variable does not chang...

The postinstall hook automatically writes package-controlled content into user-level Claude and Codex agent directories. This meets the install-control-surface blocking policy despite the...

The automatic lifecycle hook modifies consumer configuration and writes agent-control content without an explicit setup command. This meets the policy for blocking unconsented postinstall...

The automatic lifecycle mutation of a foreign, user-wide AI-agent control surface meets the blocking policy. The script is conditional on executables being present, but no consent gate li...

The automatic lifecycle hook mutates global Codex agent configuration and registers a remote MCP service. This meets the blocking policy for unconsented postinstall control-surface mutation.

The automatic post-installation of external AI authentication tooling into the global environment is a concrete unconsented lifecycle mutation. The environment gates limit scope but do no...

The automatic lifecycle hook writes an unrestricted agent configuration outside the package into a global AI-agent configuration directory. Existing-file preservation and an opt-out do no...

The automatic global lifecycle chain changes shell startup behavior and AI-client routing. This meets the blocking policy for unconsented post-install mutation of a broad AI-agent control...

The automatic post-install path defaults to mutating Cline configuration and global agent guidance when the user provides no affirmative consent. That concrete lifecycle behavior meets th...

The automatic lifecycle hook performs an enabled Cline MCP and behavior-guidance installation when the prompt receives no affirmative response. This meets the install-control-surface bloc...

The automatic global-install path changes broad AI-agent configuration and adds login persistence. Its self-updating launcher compounds the unconsented lifecycle chain.

The postinstall hook performs unconsented, broad mutation of a foreign AI-agent control surface. This meets the blocking policy for lifecycle control-surface abuse.

The automatic lifecycle chain modifies consumer configuration, agent instructions, and Git behavior. This meets the policy threshold for an install-time AI-agent control-surface attack.

The package performs a concrete, automatic postinstall chain that changes consumer lifecycle policy and installs agent-control artifacts. This meets the install-control-surface blocking p...

The automatic lifecycle chain modifies consumer package-manager configuration and agent instruction/capability locations. This meets the install-control-surface blocking policy despite no...

The automatic postinstall hook mutates a foreign, broad AI-agent control surface by installing command hooks. This meets the install-control-surface block policy.