npm AI-agent policy reports, with evidence.

The package automatically configures global Claude telemetry during installation and enables collection of sensitive agent content. This is concrete install-hook abuse, not an explicit us...

The package uses an npm postinstall hook to mutate global Claude and Codex MCP control surfaces automatically. This meets the policy definition for a blocking agent-control hijack.

The automatic lifecycle hook mutates Claude and Codex user configuration to execute package code. This is a concrete unconsented AI-agent control-surface modification.

The automatic lifecycle hook performs a broad external Claude skills mutation and destructive replacement. No user-invoked setup gate is present.

The automatic lifecycle path performs broad AI-agent configuration and plugin wiring in a consumer project. This meets the policy threshold for unconsented install-time mutation of foreig...

The package performs an automatic postinstall write to a consumer project's .claude skill directory. This concrete AI-agent control-surface mutation meets the publish-block policy.

The automatic global lifecycle path installs persistent Claude Code hooks and agent configuration. This meets the policy threshold for blocking unconsented install-time mutation of a broa...

The automatic global-install chain reaches a user-level Claude agent configuration with no interactive consent. This meets the install-control-surface blocking condition.

The automatic lifecycle hook makes unconsented changes to Claude Code's skill and command directories. This meets the install-control-surface blocking policy.

The automatic lifecycle chain performs broad AI-agent configuration mutation and installs an additional executable MCP dependency. This meets the install-control-surface blocking rule.

The package automatically rewrites a consumer application's AI module resolution during postinstall, then transmits intercepted AI run contents. This is a concrete unconsented AI-agent co...

The automatic lifecycle hook performs broad OpenClaw skill installation without user invocation. This meets the install-time AI-agent control-surface mutation block policy.

The package performs an automatic postinstall overwrite of the user's OpenClaw skills directory. This meets the install-time AI-agent control-surface mutation block policy.

The automatic lifecycle path modifies global Claude Code configuration and registers future agent hooks without consent. This meets the install-control-surface blocking boundary.

The automatic postinstall hook mutates two foreign, global AI-agent control surfaces and installs executable MCP entries without user consent. This meets the install-control-surface block...

The automatic post-install hook persistently modifies broad AI-agent configuration files and injects package-preference instructions. This meets the blocking policy for unconsented lifecy...

The automatic lifecycle hook modifies the consumer's .opencode configuration and agent content. That is concrete install-hook abuse under the stated policy.

The postinstall hook performs unconsented mutation of a consumer AI-agent control surface and applies remote package-controlled content. Signature checks limit third-party tampering but d...

The automatic npm lifecycle performs broad AI-agent configuration mutation without an explicit user command or target selection. This meets the install-control-surface blocking rule even...

The automatic global lifecycle chain modifies Claude agent configuration and can remove existing matching paths. This meets the blocking policy for unconsented postinstall mutation of a f...

The automatic lifecycle chain mutates and deletes user AI-agent configuration outside the installed package. This is a concrete unconsented install-hook control-surface attack.