npm AI-agent policy reports, with evidence.

Static source inspection confirms lifecycle-triggered writes to foreign/broad Claude skill and MCP control surfaces, including home config files and auto-latest MCP registration. Under th...

Direct source inspection confirms an unconsented npm lifecycle hook writes package-supplied AI-agent instructions/prompts into broad home-directory Claude/Codex/Cursor-style control surfa...

This is not install-time malware, but the runtime package deliberately creates a remotely reachable AI-agent control path with normal approval/sandbox protections disabled and persistent...

The source directly implements unconsented lifecycle writes into Claude skills and MCP config surfaces, which matches the firewall policy's blockable AI-agent control hijack category even...

The decisive behavior is not the user-invoked payment CLI itself but the unconsented postinstall installation of package-supplied instructions into broad/foreign AI-agent skill locations....

Source inspection confirms an install-time write to Claude's persistent skill directory, which is an unconsented AI-agent control-surface mutation. Although exfiltration was not confirmed...

The decisive behavior is the postinstall write of package-authored AI-agent instructions into the user's global Claude skills directory. This is not merely a runtime CLI feature because i...

The decisive behavior is the postinstall write into ~/.claude/skills, a persistent AI-agent instruction surface, using package-supplied content. Runtime network and shell behavior appears...

The concrete blocker is the unconsented lifecycle mutation of ~/.claude/skills with package-supplied agent instructions; this is not necessary for a normal npm CLI install and persists ou...

The confirmed behavior is an unconsented install-time mutation of AI-agent instruction/control files, with a runtime updater that can re-run the same mutation. This meets the firewall mal...

Source inspection confirms an install-time, unconsented AI-agent control-surface mutation, which is a concrete lifecycle attack behavior even though much runtime payment functionality is...

Although much of the behavior is package-aligned and documented, the default MCP-server startup path performs unconsented AI-agent control-surface writes from a remote-controlled vault/fa...

Native binary download is package-aligned for a CLI wrapper, but executing that binary during postinstall to refresh bundled agent skills is unconsented lifecycle AI-agent control-surface...

The JS source does not show credential theft or arbitrary exfiltration, but it does perform unconsented install-time execution specifically aimed at refreshing agent skills. Under the fir...

Static inspection found no install/import malware in the library bundle, but the shipped .claude local permission file is a concrete unconsented AI-agent control-surface risk that can exp...

Source inspection confirms concrete install-time AI-agent/MCP control-surface writes via package.json postinstall and bin/install.js mappings. There is no confirmed credential exfiltratio...

The payment functionality is plausibly package-aligned, but install-time mutation of AI-agent skill/control files is unconsented and durable. That concrete lifecycle behavior meets the fi...

Source inspection confirms install-time mutation of AI-agent control files, which is not necessary for a CLI library install and persists behavior outside the package. Package-aligned pay...

Source inspection confirms concrete install-time writes to .cursor/.claude/.codex/.openclaw instruction surfaces and package.json, which matches the firewall's AI-agent control hijack blo...

Static inspection confirms an install-time write to user-level GoodVibes instruction locations containing mandatory agent directives. That constitutes unconsented lifecycle AI-agent contr...

The source confirms unconsented install-time mutation of AI-agent control files and a background self-update path that reruns that mutation. Even though the payment/network code largely m...