npm AI-agent policy reports, with evidence.

This is an unconsented postinstall mutation of a broad AI-agent control surface that enables export of sensitive session content. The opt-out environment variable does not establish prior...

The automatic lifecycle hook modifies global Claude telemetry settings and enables collection of sensitive AI-session content for remote export. This is concrete unconsented AI-agent cont...

This is an automatic install-time mutation of broad, foreign AI-agent control surfaces, which meets the blocking policy. Package-aligned API traffic does not neutralize that persistence b...

The automatic postinstall hook installs a separate global AI-agent package and persists user-environment changes. This meets the install-time foreign AI-agent control-surface mutation blo...

The automatic lifecycle hook mutates broad AI-agent skill directories and installs enabled collection settings without an explicit user setup action. This meets the install-time AI-agent...

This is an unconsented postinstall mutation of a broad AI-agent control surface combined with automatic remote collection of Claude interaction content. The opt-out does not establish pri...

This is a concrete unconsented postinstall mutation of a broad AI-agent control surface. The automatic lifecycle chain is sufficient for a block even though no automatic secret exfiltrati...

The package has a registry-install postinstall hook that changes multiple foreign AI-agent configurations and activates a Codex plugin. This concrete install-time control-surface mutation...

This package automatically mutates global Claude Code configuration and instructions during npm installation, without interactive consent. That is concrete install-hook abuse against a br...

The package performs automatic postinstall mutation of numerous third-party AI-agent configurations and installs a separate executable MCP dependency. This is a concrete install-hook abus...

The automatic postinstall modification of AGENTS.md and agent skill files is a concrete broad AI-agent control-surface write. Its project and non-clobber guards reduce accidental file los...

The automatic lifecycle hook performs broad, destructive mutation of a consumer AI-agent control surface. This meets the install-time control-surface block policy even though no exfiltrat...

This is a concrete automatic postinstall mutation of a broad AI-agent control surface that enables external collection of sensitive interaction content. The opt-out does not establish pri...

The postinstall hook automatically invokes a command that mutates global Claude Code configuration, rather than limiting setup to an explicit user command. This meets the blocking policy...

Automatic postinstall configuration exports sensitive AI-session content and rewrites global Claude settings without a user command. The accompanying project-wide hook and permission depl...

This is an unconsented postinstall mutation of a broad AI-agent control surface with persistent hook execution. The explicit feedback transport does not offset that install-time behavior.

The package uses an automatic lifecycle hook to alter global Claude telemetry and enable export of sensitive AI-session content. The opt-out environment variable does not establish prior...

This is malicious install-hook abuse: an automatic postinstall modifies foreign AI-agent control surfaces and installs hooks that collect session context for later telemetry. The user-inv...

The automatic postinstall persists and registers package code in global Claude Code settings for all sessions. This meets the policy for malicious install-hook abuse even without demonstr...

This is a concrete unconsented postinstall mutation of a broad, foreign AI-agent skills directory. Checksum verification and limited telemetry do not remove the risk created by automatic...

The package has a concrete automatic postinstall chain that mutates foreign and broad AI-agent control surfaces. This meets the install-hook abuse blocking policy despite no observed netw...