npm AI-agent policy reports, with evidence.

The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cl...

The postinstall hook concretely performs unconsented mutation of the consuming project's .claude control surface. Although its content is a benign guide and no exfiltration was found, thi...

Source inspection confirms the lifecycle hook mutates a third-party AI-agent package. Under the install-control-surface policy, this warrants blocking even though the patch is narrow and...

The package has a concrete unconsented postinstall mutation chain targeting broad third-party AI-agent control surfaces. The absence of install-time networking does not mitigate that pers...

This is concrete, unconsented postinstall mutation of foreign global AI-agent control surfaces, including a persistent Codex lifecycle execution hook. The absence of install-time network...

Source inspection confirms the lifecycle installer performs broad foreign AI-agent configuration writes. This meets the blocking policy regardless of the absence of network exfiltration.

The lifecycle behavior itself meets the block boundary: postinstall mutates multiple foreign AI-agent control surfaces, rather than requiring an explicit setup command. No exfiltration wa...

The postinstall behavior directly meets the blocking policy for unconsented mutation of foreign/broad AI-agent control surfaces. Opt-out flags do not make the default installation consens...

Source confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the firewall block boundary even though no exfiltration or fixed remote payload wa...

The source establishes the policy-defined blocking condition: automatic lifecycle mutation of broad, foreign AI-agent configuration surfaces. No separate exfiltration or remote execution...

Source inspection confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the blocking policy. No network exfiltration is needed for this c...

Source inspection confirms a concrete unconsented postinstall persistence chain across foreign AI-agent configurations. No exfiltration was found, but the lifecycle control-surface mutati...

The concrete postinstall mutation of a consuming project's root CLAUDE.md meets the foreign/broad AI-agent control-surface blocking policy. No exfiltration was found, but it is not needed...

The source confirms an unconsented install-time write to consumer project agent-control files. This meets the policy's publish-block condition despite the absence of exfiltration or runti...

The package contains a concrete install-time takeover of an existing Hermes control surface, rather than merely an explicit user-invoked setup flow. That meets the blocking policy even th...

Source inspection confirms concrete postinstall mutation of consumer AI-agent configuration across several platforms. Under the stated policy, this requires blocking even though no direct...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. The absence of observed exfiltration does not mitigate th...

Direct inspection confirms an install-time write to the user's globally discovered OpenCode command directory. This meets the firewall policy for unconsented postinstall mutation of a for...

The postinstall hook establishes persistent, package-authored commands in a user-wide agent configuration location. This meets the blocking policy for unconsented install-time AI-agent co...

This is a concrete, unconsented install-time mutation of a foreign AI-agent control surface, even though the behavior is documented and conditional. No network exfiltration or concealed p...

This is concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking policy. Collision checks reduce overwrite risk but do not remove the in...