npm AI-agent policy reports, with evidence.

Static inspection confirms unconsented install-time mutation of ~/.claude/skills, a foreign/broad AI-agent control surface, via package lifecycle script. Under the provided install contro...

This matches the blockable policy for unconsented lifecycle mutation of foreign or broad AI-agent control surfaces, even though the content appears package-aligned and no exfiltration end...

Source inspection confirms unconsented postinstall writes into ~/.claude/skills, which the policy treats as blockable AI-agent control hijack even when the planted instructions are produc...

Direct source inspection confirms unconsented lifecycle mutation of multiple foreign/broad AI-agent control surfaces, which the policy treats as blockable AI-agent control hijack even whe...

The package performs unconsented install-time delivery of package-supplied Claude skills into ~/.claude/skills, which matches the firewall policy for blockable AI-agent control hijack. Th...

Under the supplied policy, lifecycle code that drops package-supplied Claude/agent control files into a consumer project without consent is blockable even when content is product-aligned....

The package crosses the block boundary because a lifecycle hook silently registers a package-controlled MCP server into Codex, a foreign/broad AI-agent control surface. The planted tools...

Source inspection confirms package.json lifecycle execution and install-time writes/registration into Trae, Cursor, Claude/MCP-style agent surfaces outside the package namespace. This mat...

Source inspection confirms automatic postinstall writes into consumer .claude agent-control paths, matching the blockable AI-agent control hijack policy. The native pruning and restart no...

Direct source inspection confirms a postinstall lifecycle script that installs package-supplied instructions into multiple home-level AI-agent surfaces by default. Under the supplied inst...

Static source inspection confirms lifecycle-triggered writes to foreign/broad Claude skill and MCP control surfaces, including home config files and auto-latest MCP registration. Under th...

Direct source inspection confirms an unconsented npm lifecycle hook writes package-supplied AI-agent instructions/prompts into broad home-directory Claude/Codex/Cursor-style control surfa...

This is not install-time malware, but the runtime package deliberately creates a remotely reachable AI-agent control path with normal approval/sandbox protections disabled and persistent...

The source directly implements unconsented lifecycle writes into Claude skills and MCP config surfaces, which matches the firewall policy's blockable AI-agent control hijack category even...

The decisive behavior is not the user-invoked payment CLI itself but the unconsented postinstall installation of package-supplied instructions into broad/foreign AI-agent skill locations....

Source inspection confirms an install-time write to Claude's persistent skill directory, which is an unconsented AI-agent control-surface mutation. Although exfiltration was not confirmed...

The decisive behavior is the postinstall write of package-authored AI-agent instructions into the user's global Claude skills directory. This is not merely a runtime CLI feature because i...

The decisive behavior is the postinstall write into ~/.claude/skills, a persistent AI-agent instruction surface, using package-supplied content. Runtime network and shell behavior appears...

The concrete blocker is the unconsented lifecycle mutation of ~/.claude/skills with package-supplied agent instructions; this is not necessary for a normal npm CLI install and persists ou...

The confirmed behavior is an unconsented install-time mutation of AI-agent instruction/control files, with a runtime updater that can re-run the same mutation. This meets the firewall mal...

Source inspection confirms an install-time, unconsented AI-agent control-surface mutation, which is a concrete lifecycle attack behavior even though much runtime payment functionality is...