npm AI-agent policy reports, with evidence.

The package performs unconsented postinstall mutation of a broad, user-level OpenCode command surface. This concrete lifecycle control-surface write meets the blocking policy even though...

The package performs the policy-defined blocking behavior directly at npm postinstall: broad AI-agent configuration mutation without an explicit user command.

The concrete unconsented postinstall mutation of broad AI-agent control surfaces meets the firewall block policy. Branding and visible error handling do not remove that install-time contr...

Source inspection confirms the policy-blocking install-time mutation of a broad, user-level OpenCode command surface. No separate encrypted payload execution or exfiltration was confirmed...

The automatic postinstall is a concrete broad agent-control mutation, meeting the blocking policy even though no separate exfiltration behavior was confirmed.

The source confirms automatic postinstall installation into ~/.agents/skills/, not merely a user-invoked setup command. This meets the install-control-surface block boundary.

The package has concrete unconsented postinstall mutation of global Claude Code and Codex MCP configuration. This meets the install-control-surface block criterion regardless of the absen...

Source inspection confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, which meets the blocking policy. The lifecycle hook additionally performs remot...

The lifecycle behavior is package-controlled and alters host Claude Code configuration/plugins during installation. Under the stated policy, that warrants blocking even though no credenti...

Direct source inspection confirms unconsented postinstall mutation of the consuming project’s Claude plugin/configuration surface. This meets the firewall policy’s blocking condition for...

This is a concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. No separate exfiltration chain is needed for the blocking verdict.

This is concrete, unconsented postinstall mutation of foreign project-level AI-agent control files. The lack of exfiltration does not mitigate that policy-defined control-surface hijack.

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. Absence of exfiltration does not remove the persistent prompt/control hijack risk.

This is a concrete unconsented postinstall mutation of a generic host AI-agent directory, not merely an explicit CLI setup command. No additional exfiltration behavior was found, but the...

Source inspection confirms concrete postinstall mutation of global OpenCode and ~/.agents control surfaces, exceeding first-party project setup. The absence of exfiltration does not mitig...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The subsequent plugin behavior compounds the risk through aut...

This is a concrete unconsented postinstall mutation of foreign project-root AI-agent control files. Per policy, that lifecycle behavior warrants blocking even though no exfiltration was f...

Source inspection confirms an unconsented postinstall mutation of ~/.claude.json and ~/.codex/config.toml. This meets the blocking AI-agent control-hijack boundary regardless of the scann...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote binary execution and broad host changes. It meets the firewall block policy ir...

The package contains a concrete, unconsented postinstall mutation of broad AI-agent control surfaces, including a persistent Codex lifecycle executable. This meets the install-control-sur...

This is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this ver...