npm AI-agent policy reports, with evidence.

The automatic postinstall mutation of the consumer project's Claude skill directory meets the install-control-surface block policy. The absence of network activity does not neutralize the...

Automatic postinstall writes agent skills into the consuming project and can add remotely fetched skills. That is concrete unconsented mutation of a broad AI-agent control surface.

This is an unconsented install-time mutation of a foreign global AI-agent control surface. Integrity checks for the downloaded binary do not remove the risk created by automatic Cursor co...

This is an unconsented install-time AI-agent control-surface action implemented through an opaque remotely fetched executable. Its automatic execution and fail-open verification create a...

This is concrete, automatic post-install mutation of a consumer project's broad AI-agent control surface, combined with persistent Git-hook execution. That meets the install-control-surfa...

The package has a concrete automatic postinstall path that modifies global AI-agent configuration and establishes future command execution. This meets the install-time AI-agent control-hi...

The package performs automatic postinstall mutation of foreign, user-wide AI-agent settings and permissions. The lifecycle guard and lack of observed exfiltration do not remove the concre...

Source inspection confirms unconsented postinstall mutation of global Claude Code configuration and instructions. This meets the install-control-surface blocking policy even though no cre...

This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, including automatic command execution. The absence of demonstrated exfiltration does not neutra...

The automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion e...

This is a concrete postinstall chain that downloads opaque native code and automatically mutates AI-agent hooks/settings. It meets the install-control-surface blocking policy despite no v...

This is unconsented postinstall mutation of a broad AI-agent control surface, not merely an explicit user-invoked integration setup. The lifecycle path establishes persistent package comm...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The lifecycle hook, global writes, and agent-directing payload form a concrete install-hook abuse...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The lifecycle hook directly registers a server for both Claude Code and Codex.

The automatic postinstall hook writes global Claude Code and Codex MCP configuration and registers package-controlled executable code. This meets the install-hook abuse policy even though...

This is unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle hook persists package-controlled commands and instructions in the user's global Claude Code con...

The automatic lifecycle hook mutates a foreign global AI-agent installation and persistent user configuration. This is a concrete install-time control-surface risk even though no credenti...

The automatic postinstall hook broadly mutates foreign AI-agent configuration and establishes a self-updating execution path through local-mcp@latest and remote binaries. This is concrete...

The package uses an automatic npm lifecycle hook to mutate several foreign global AI-agent skill directories and to obtain content from the network. This is a concrete unconsented control...

The package performs unconsented postinstall mutation of an external AI-agent control surface and broad user-home cleanup. Its automatic executable download adds a separate supply-chain r...

The package automatically installs unrestricted global Claude Code hooks rather than requiring an explicit user setup action. This meets the install-time AI-agent control-surface abuse bl...