npm AI-agent policy reports, with evidence.

Source inspection confirms unconsented lifecycle mutation of foreign/broad AI-agent control surfaces, which is blockable under the install-control-surface policy even though the content a...

The decisive issue is lifecycle-triggered mutation of a home MCP control surface and service setup, not scanner similarity alone. Under the install-control-surface policy, unconsented pos...

Source inspection confirms install-time writes to OpenCode's home config and plugin registry, followed by agent control hooks in the plugin bundle. Under the lifecycle control-surface pol...

Although the planted skills are business-analysis aligned and no exfiltration was found, the package automatically writes AI-agent control files into the consumer project during postinsta...

Source inspection confirms unconsented lifecycle mutation of a broad/project AI-agent control surface via .opencode/skills, which matches the block policy even though the planted content...

Source inspection confirms unguarded install-time writes to .opencode/skills, which falls under the policy's blockable AI-agent control hijack category. The runtime analyzer code is other...

Although the package functionality is mostly aligned with image/podcast generation, the lifecycle hook unconditionally plants agent skill files into .opencode/skills, a broad AI-agent con...

Static inspection confirms unconsented npm lifecycle mutation of a project AI-agent skill surface, which matches the firewall policy for ai_agent_control_hijack. No additional credential...

Although the CLI runtime behavior is largely aligned with LSP/refactoring functionality, the unguarded install-time write into ~/.claude/skills matches the policy for unconsented lifecycl...

The confirmed issue is not classic malware or exfiltration, but the package uses an npm lifecycle hook to plant agent skill files into a project-level .opencode control surface without co...

Although the skill content appears product-aligned and no exfiltration or shell execution was found, the unconsented postinstall write into a broad AI-agent control surface matches the bl...

The package has no credential theft, exfiltration, remote code execution, or destructive runtime behavior, but the postinstall hook unconditionally plants AI-agent skill files into a proj...

The package has benign runtime book-writing code, but its install hook unconditionally writes package instructions into a project-level AI-agent skills directory. Under the install contro...

The runtime library is benign local code analysis, but the lifecycle hook unconditionally plants agent instructions into a project-level .opencode skill surface. Under the install control...

Source inspection confirms automatic lifecycle installation into .opencode/skills, which falls under unconsented AI-agent control-surface mutation. The absence of exfiltration or classic...

Although the payload is a notification feature and no exfiltration is present, the package uses an npm postinstall hook to modify ~/.claude/settings.json and register Claude Code executio...

Although the content is product-aligned and there is no exfiltration or remote code execution, lifecycle-triggered writes into ~/.claude/skills are an unconsented mutation of a foreign AI...

The package's core behavior is an install-time rewrite of Claude Code's global hooks/settings, which matches the blockable AI-agent control-hijack policy even though no classic malware or...

Although the payload is product-aligned and lacks network exfiltration, it is lifecycle-triggered and unconditionally rewrites a broad foreign AI-agent control surface under ~/.claude. Un...

Static source inspection confirms install-time code plants repository-wide AGENTS.md instructions, which the supplied policy treats as blockable AI-agent control hijack when lifecycle-tri...

The concrete issue is not classic malware but lifecycle-triggered mutation of Claude Code control files in the consuming project, which the policy treats as blockable AI-agent control hij...