npm AI-agent policy reports, with evidence.

The concrete malicious behavior is the unconsented postinstall write into broad/foreign AI-agent control surfaces, which the policy says to block. The network and CLI API behavior otherwi...

Source inspection confirms automatic postinstall writes to .cursor hooks.json and an executable hook that injects agent instructions, which meets the firewall policy for blocking unconsen...

Source inspection confirms a postinstall hook that mutates a foreign dependency's OAuth/auth UI surface, which meets the firewall block boundary for unconsented install-time control-surfa...

Static inspection confirms unconsented npm postinstall mutation of a broad foreign AI-agent control surface, which meets the firewall block policy even without credential theft or exfiltr...

Source inspection confirms unconsented install-time mutation of ~/.claude/commands, a broad AI-agent control surface, which meets the firewall block policy even without exfiltration. Othe...

Static source inspection confirms unconsented install-time mutation of broad AI-agent control surfaces, which meets the firewall block policy even without confirmed credential exfiltratio...

Static inspection confirms install-time writes into several foreign AI-agent skill directories via postinstall. Under the install-control policy this is concrete unconsented mutation of b...

Source inspection confirms unconsented npm postinstall mutation of a broad Claude/AI-agent control surface, which meets the firewall block policy even without observed exfiltration. The b...

Source inspection confirms unconsented postinstall mutation of a broad/foreign Claude AI-agent control surface. No exfiltration was found, but the install-time global skill drop meets the...

Source inspection confirms install-time mutation of foreign/broad AI-agent MCP and instruction surfaces, which matches the firewall block policy even without observed exfiltration. The be...

Static inspection confirms install-time writes into foreign AI-agent MCP and instruction surfaces across workspace and user scopes. Although no exfiltration or destructive payload was fou...

The package crosses the firewall block boundary because postinstall mutates a foreign AI-agent/OAuth surface, even though the observed payload is branding-only and no credential exfiltrat...

The package performs unconsented postinstall mutation of a foreign dependency's OAuth control surface, which matches the blocking policy even though the observed payload is branding rathe...

Source inspection confirms unconsented lifecycle mutation of foreign/broad AI-agent control surfaces, which is blockable under the install-control-surface policy even though the content a...

The decisive issue is lifecycle-triggered mutation of a home MCP control surface and service setup, not scanner similarity alone. Under the install-control-surface policy, unconsented pos...

Source inspection confirms install-time writes to OpenCode's home config and plugin registry, followed by agent control hooks in the plugin bundle. Under the lifecycle control-surface pol...

Although the planted skills are business-analysis aligned and no exfiltration was found, the package automatically writes AI-agent control files into the consumer project during postinsta...

Source inspection confirms unconsented lifecycle mutation of a broad/project AI-agent control surface via .opencode/skills, which matches the block policy even though the planted content...

Source inspection confirms unguarded install-time writes to .opencode/skills, which falls under the policy's blockable AI-agent control hijack category. The runtime analyzer code is other...

Although the package functionality is mostly aligned with image/podcast generation, the lifecycle hook unconditionally plants agent skill files into .opencode/skills, a broad AI-agent con...

Static inspection confirms unconsented npm lifecycle mutation of a project AI-agent skill surface, which matches the firewall policy for ai_agent_control_hijack. No additional credential...