npm AI-agent policy reports, with evidence.

Source inspection confirms the policy-blocking install-time mutation of a broad, user-level OpenCode command surface. No separate encrypted payload execution or exfiltration was confirmed...

The automatic postinstall is a concrete broad agent-control mutation, meeting the blocking policy even though no separate exfiltration behavior was confirmed.

The source confirms automatic postinstall installation into ~/.agents/skills/, not merely a user-invoked setup command. This meets the install-control-surface block boundary.

The package has concrete unconsented postinstall mutation of global Claude Code and Codex MCP configuration. This meets the install-control-surface block criterion regardless of the absen...

Source inspection confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, which meets the blocking policy. The lifecycle hook additionally performs remot...

The lifecycle behavior is package-controlled and alters host Claude Code configuration/plugins during installation. Under the stated policy, that warrants blocking even though no credenti...

Direct source inspection confirms unconsented postinstall mutation of the consuming project’s Claude plugin/configuration surface. This meets the firewall policy’s blocking condition for...

This is a concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. No separate exfiltration chain is needed for the blocking verdict.

This is concrete, unconsented postinstall mutation of foreign project-level AI-agent control files. The lack of exfiltration does not mitigate that policy-defined control-surface hijack.

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. Absence of exfiltration does not remove the persistent prompt/control hijack risk.

This is a concrete unconsented postinstall mutation of a generic host AI-agent directory, not merely an explicit CLI setup command. No additional exfiltration behavior was found, but the...

Source inspection confirms concrete postinstall mutation of global OpenCode and ~/.agents control surfaces, exceeding first-party project setup. The absence of exfiltration does not mitig...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The subsequent plugin behavior compounds the risk through aut...

This is a concrete unconsented postinstall mutation of foreign project-root AI-agent control files. Per policy, that lifecycle behavior warrants blocking even though no exfiltration was f...

Source inspection confirms an unconsented postinstall mutation of ~/.claude.json and ~/.codex/config.toml. This meets the blocking AI-agent control-hijack boundary regardless of the scann...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote binary execution and broad host changes. It meets the firewall block policy ir...

The package contains a concrete, unconsented postinstall mutation of broad AI-agent control surfaces, including a persistent Codex lifecycle executable. This meets the install-control-sur...

This is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this ver...

Direct source inspection confirms concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. The opt-out does not establish user consent.

The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cl...

The postinstall hook concretely performs unconsented mutation of the consuming project's .claude control surface. Although its content is a benign guide and no exfiltration was found, thi...