npm AI-agent policy reports, with evidence.

The postinstall behavior concretely injects downloaded plugin code into OpenCode's configuration directory, while the package documentation describes a separate Capix configuration path....

This is an unconsented postinstall mutation of a foreign AI-agent control surface, coupled to remote payload installation. The absence of direct source-level credential theft does not rem...

Direct source inspection confirms a concrete postinstall chain that persists remote code and writes OpenCode plugin/provider configuration. The same-origin checksum does not establish ind...

The package performs a concrete, unconsented postinstall modification of OpenCode configuration and makes it load plugin paths supplied by a remotely downloaded runtime. The adjacent chec...

Source inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surf...

This is an unconsented install-time mutation of a foreign AI-agent control surface, coupled with an external payload bootstrap. Documentation makes the behavior less stealthy but does not...

The package's own source confirms a concrete automatic postinstall chain that stages remote code and rewrites a foreign OpenCode configuration. The checksum does not independently constra...

This meets the blocking policy because npm postinstall automatically mutates a foreign/broad AI-agent control surface. The package’s deferred hook-trust behavior reduces scope but does no...

Source inspection confirms the lifecycle hook performs the concrete chain; this is not merely a static heuristic. Its install-time OpenCode configuration write and unsigned remote runtime...

Source inspection confirms the scanner’s core finding: the package performs global AI-agent configuration and third-party skill installation during npm postinstall. That concrete behavior...

The package is transparent about its behavior, but the behavior is still an unconsented global-install lifecycle mutation of broad AI-agent control surfaces. Under the firewall policy, th...

The inspected source confirms the scanner's central claim: a `postinstall` performs automatic global Claude skill and MCP registration. This meets the firewall policy for a block regardle...

The package’s postinstall hook silently writes packaged agent instructions into multiple third-party agent configuration locations. Under the firewall policy, this lifecycle-driven broad...

The package has no confirmed exfiltration chain, but its install hook automatically replaces a globally discovered Claude Code skill. Under the firewall policy, this concrete postinstall...

Direct source inspection confirms an automatic postinstall persistence chain into user-wide Claude control surfaces, not merely scanner similarity. This meets the block boundary for uncon...

Source inspection confirms concrete install-time mutation of foreign consumer AI-agent configuration surfaces, not merely scanner hints. This meets the blocking policy despite safeguards...

This is a concrete, unconsented `postinstall` mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. The remote binary bootstrap increases impact, even thou...

The install hook performs the policy-defined blocking behavior: unconsented `postinstall` writes to global AI-agent control paths. Lack of network or credential theft does not remove that...

This is a concrete postinstall mutation of a foreign project’s broad AI-agent control surface. The benign design-system purpose and overwrite guard do not remove the unconsented lifecycle...

The concrete postinstall overwrite of consumer `.claude/skills` meets the blocking policy for unconsented mutation of a foreign/broad AI-agent control surface. No separate exfiltration ch...

The package has a concrete unconsented postinstall path that installs hooks into existing Claude Code/Codex environments. Checksum validation limits tampering of the chosen release asset...