npm AI-agent policy reports, with evidence.

The active postinstall lifecycle performs broad AI-agent configuration changes in the consumer project without an explicit user command. This meets the install-hook control-surface blocki...

The global postinstall chain automatically installs package-controlled agent content into the user's Claude Code configuration. This meets the install-control-surface blocking rule even t...

The package performs concrete, automatic npm lifecycle changes to a foreign AI-agent configuration and MCP control surface. This meets the install-control-surface blocking rule.

The automatic postinstall hook rewrites a foreign AI coding-agent dependency rather than limiting setup to this package's own files. This meets the install-control-surface blocking condit...

The package performs unconsented postinstall writes to a foreign AI-agent control surface. Guardrails limit when the DSH patch applies but do not remove the automatic command-catalog muta...

The automatic postinstall performs both user-level agent skill installation and foreign host-file mutation. Those concrete lifecycle actions meet the blocking policy for unconsented broad...

This release performs automatic postinstall writes to a foreign AI-agent host and user-level skill catalog. That concrete control-surface mutation meets the blocking policy despite its st...

The postinstall hook writes this package into many third-party AI skill directories and registers a second global package in their MCP configs without a separate user command. That is unc...

The package automatically modifies both Claude and Codex MCP configuration during postinstall. This satisfies the policy's concrete block condition for unconsented lifecycle mutation of f...

The postinstall hook silently rewrites a foreign OpenCode control surface and installs extra global agent packages, which is unconsented agent-control mutation. Product-aligned plugin set...

The postinstall hook mutates broad, foreign AI-agent control surfaces and shell startup files without a user command, and later MCP startup continues that mutation. Silencing setup errors...

The automatic postinstall execution of an externally downloaded binary with an agent-hook installation argument is a concrete unconsented AI-agent control-surface risk. Static source does...

Postinstall fetches and runs a binary whose only automatic argument installs hooks into Codex and Claude Code, which are foreign agent control surfaces. That is unconsented install-time a...

The package lifecycle hook installs and rewires OpenCode, Grok, Hermes, OpenClaw, and Cursor agent configuration, including user-home Hermes and OpenClaw files, without an install-time co...

This is unconsented postinstall mutation of a broad AI-agent control surface that enables remote collection of Claude session content. The automatic trigger and persistent global configur...

The postinstall hook unconditionally mutates the user's global Claude Code settings, tool hooks, and MCP registration. That is an unconsented install-time write to a broad foreign agent c...

The postinstall hook writes Cursor, Claude Code, and Copilot instruction files into the consumer project and loosens .npmrc lifecycle and lockfile settings with no separate consent step....

The automatic lifecycle hook performs broad consumer-project AI-agent configuration changes rather than limiting work to the package directory or an explicit user command. This meets the...

The postinstall hook unconditionally mutates the consumer .npmrc and writes several foreign agent instruction and skill locations. That is an unconsented install-time takeover of a broad...

The postinstall hook unconditionally rewrites the consumer .npmrc and installs agent rules, Copilot instructions, and Claude skills into the project, which is an unconsented broad AI-agen...

npm postinstall, without a consent prompt, rewrites the consumer .npmrc and plants broad Claude, Cursor, and Copilot instruction files plus Claude skills. That is unconsented install-time...