npm AI-agent policy reports, with evidence.

Direct inspection confirms the lifecycle script writes package-controlled instructions into existing ~/.claude and ~/.codex installations. This meets the blocking policy regardless of the...

Direct inspection confirms the postinstall drop into ~/.claude and ~/.codex, not merely scanner inference. This meets the firewall block boundary for unconsented postinstall mutation of b...

The lifecycle hook performs an unconsented install-time mutation of existing Claude Code/Codex control surfaces. This meets the firewall blocking boundary regardless of the package’s stat...

Source confirms an unconsented postinstall mutation of a foreign, broad AI-agent control surface. README disclosure and an opt-out do not change that automatic install-time behavior.

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, which meets the blocking policy. Remote binary execution and additional host mutations increase imp...

The lifecycle hook establishes persistent, package-controlled global agent commands without an explicit user command. This meets the install-time AI-agent control-hijack blocking boundary.

The package has concrete unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the blocking policy despite benign validation and explicit deploy-ke...

Direct inspection confirms a postinstall hook writes package-supplied AI-agent commands into the user-level OpenCode command directory. This meets the blocking policy for unconsented life...

Direct source inspection confirms the lifecycle hook force-installs agent instructions outside the package directory. This meets the blocking policy for unconsented postinstall mutation o...

Source inspection confirms the lifecycle hook creates a persistent global OpenCode prompt channel and overwrites command names. Scanner claims of encrypted temporary payload execution and...

Source inspection confirms the concrete install-time OpenCode control-surface mutation required for blocking. Scanner claims of encrypted payload execution were not corroborated, but are...

Direct source inspection confirms the lifecycle hook performs forced user-level OpenCode command injection. This meets the firewall block policy regardless of the scanner's unrelated bund...

Source inspection confirms concrete postinstall mutation of host and user AI-agent configuration, exceeding a normal dependency install boundary. This meets the firewall policy for a publ...

This is unconsented install-time mutation of broad third-party AI-agent control surfaces, coupled to remote executable delivery and persistence. The skips and uninstall behavior do not re...

The package performs unconsented postinstall mutation of a global AI-agent command surface, not merely package-local setup. The lack of observed install-time exfiltration does not remove...

The package has a concrete unconsented postinstall path that mutates a broad AI-agent control surface. Under the install-control-surface policy, this requires blocking regardless of the b...

The lifecycle hook performs broad AI-agent skill installation automatically rather than through an explicit user command. This meets the blocking policy for unconsented postinstall mutati...

Direct source inspection confirms the policy-defined blocking behavior, independent of scanner labels. The bundled payload appears product-aligned, but its unconsented broad postinstall d...

Source inspection confirms the scanner’s lifecycle concern: this is not inert code or an explicit user command. The automatic broad agent-host skill installation meets the firewall block...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface. The benign-looking skill content does not remove that install-time control-surface risk.

Source confirms unconsented postinstall mutation of foreign/broad AI-agent configuration via a remotely resolved npx installer. This meets the install-control-surface block boundary.