npm AI-agent policy reports, with evidence.

The wrapper source establishes an automatic install-time path into documented agent-plugin and persistent-daemon setup. Although the binary is absent and no exfiltration is shown, this me...

Source inspection confirms an automatic postinstall write to both `~/.claude/skills` and `~/.agents/skills`, which is a foreign/broad AI-agent control surface. The unattended global updat...

Source inspection confirms a concrete postinstall write into foreign global AI-agent skill directories. Under the install-control-surface policy, this requires blocking regardless of othe...

Direct inspection confirms an unconsented postinstall write to foreign, broad AI-agent control surfaces. This meets the blocking policy regardless of otherwise package-aligned browser aut...

This is concrete, unconsented postinstall mutation of a foreign and broad AI-agent control surface. The absence of observed exfiltration does not remove the install-time control-hijack be...

Direct source inspection confirms unconsented postinstall injection into both global agent skill locations. This meets the blocking policy regardless of the absence of credential exfiltra...

Source inspection confirms unconsented postinstall mutation of foreign project AI-agent control surfaces. This meets the block boundary regardless of benign-looking ancillary features and...

This package performs an unconsented `postinstall` write into foreign global AI-agent skill locations, not merely a package-owned setup directory. That meets the firewall policy's publish...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic foreign AI-agent configuration mutation meets the block boundary even though no separ...

The install hook performs concrete persistence into global Claude Code configuration rather than limiting setup to an explicit user command or project-local configuration. Under the firew...

The lifecycle hook automatically initiates documented cross-agent plugin and daemon setup, rather than requiring the user to run setup explicitly. No source-visible credential theft or ne...

The lifecycle hook makes persistent changes to foreign project AI-agent instruction files by default. Although the payload is visible and package-aligned, the unconsented postinstall cont...

The lifecycle hook performs concrete, automatic writes to Claude Code and Codex configuration files that cause package-controlled MCP code to be loaded later. This meets the blocking poli...

The package performs concrete, unconsented postinstall writes to consumer AI-agent configuration paths. Although no exfiltration or remote payload execution is present, this meets the fir...

Source inspection confirms a concrete install-time AI-agent control-surface write, not merely scanner similarity. The node_modules guard and absence of observed exfiltration do not mitiga...

This is a concrete npm postinstall mutation of foreign project AI-agent control files, including a default-all path. No network exfiltration is needed for this behavior to meet the instal...

Source inspection confirms a concrete automatic postinstall control-surface write into the host project. This meets the firewall block policy for unconsented npm lifecycle mutation of for...

The source confirms the scanner’s core finding: postinstall automatically installs package-controlled Claude skills into the user’s global Claude configuration. Under the firewall policy,...

Direct source inspection confirms a postinstall hook injects package code into every Claude Code tool call and captures its inputs. Loopback defaults reduce external-exfiltration certaint...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, meeting the firewall block boundary despite otherwise recognizable MCP functionality.

The package performs an unconsented postinstall overwrite of a foreign/broad AI-agent control surface. This meets the blocking boundary despite no observed exfiltration or remote payload...