npm AI-agent policy reports, with evidence.

The package has a concrete postinstall persistence mechanism targeting multiple foreign/broad AI-agent instruction directories. The benign binary launcher does not mitigate this automatic...

The package performs an unconsented install-time write to consumer-owned AI-agent instruction files. This concrete behavior meets the blocking policy despite the absence of exfiltration o...

The package performs unconsented install-time registration of a Chrome MCP bridge, a foreign/broad AI-agent control surface. No direct exfiltration was confirmed, but the lifecycle mutati...

Source inspection confirms a concrete lifecycle-triggered remote payload write into Claude Code, Codex, and OpenClaw directories. This meets the blocking policy regardless of the package'...

The package contains a concrete, unconsented postinstall mutation of foreign project AI-agent instruction files. Benign UI bundle contents do not mitigate this lifecycle control-surface h...

Source inspection confirms a real postinstall chain that automatically installs agent skills across multiple host AI-tool directories. Documentation and prefix-scoped cleanup reduce ambig...

The concrete postinstall behavior mutates broad, foreign AI-agent skill directories. This meets the block boundary even though the inspected installer path showed no network exfiltration.

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces, not merely an explicit setup command. The source confirms the behavior directly.

Direct source inspection confirms unconsented postinstall modification of broad consumer AI-agent control surfaces. This meets the firewall block boundary even without separate credential...

The lifecycle code concretely performs automatic setup, and package source documents that setup modifies AI-agent CLIs and creates persistent daemon behavior. This meets the firewall bloc...

This package concretely performs unconsented postinstall writes to multiple global AI-agent instruction surfaces, meeting the blocking policy. Package-aligned checksum verification reduce...

Source inspection confirms unconsented postinstall writes to multiple foreign/broad AI-agent control surfaces. Remote binary bootstrap increases impact, despite no direct credential theft...

Source inspection confirms the scanner's core finding: the package performs automatic postinstall writes into the consumer project, including MCP configuration. The absence of an observed...

This is a concrete unconsented postinstall mutation of foreign AI-agent control files, meeting the firewall block boundary. The user-invoked CLI capabilities do not mitigate the install-t...

Source inspection confirms a concrete postinstall control-surface mutation, not merely scanner similarity. Marker merging and limited CLAUDE safeguards do not remove the default unconsent...

The package has a concrete, automatic postinstall chain that modifies foreign project-level AI-agent control files and defaults to all targets. No exfiltration was found, but the control-...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. The lack of exfiltration does not mitigate the install-control-surface violation.

Direct source inspection confirms an unconsented `postinstall` writes package-supplied, auto-invocable instructions into foreign global AI-agent control surfaces. This meets the blocking...

This is a policy-defined AI-agent control hijack: normal registry installation modifies foreign project and home AI-agent control surfaces and registers an executable MCP server without r...

Source inspection confirms unconsented install-time mutation of global Codex configuration, instructions, and skills. This meets the blocking boundary even though no separate credential t...

Source confirms a concrete unconsented postinstall mutation of consumer-project AI-agent control files. The absence of exfiltration does not remove this foreign broad control-surface hijack.