npm AI-agent policy reports, with evidence.

This package automatically executes an opaque binary to mutate Codex and Claude Code hook/configuration surfaces during installation. That meets the install-time foreign AI-agent control-...

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The conditional binary check does not provide user consent, and error suppression conceals the au...

The automatic postinstall mutation targets broad, foreign AI-agent control surfaces and is coupled with user-level dependency installation. This meets the install-hook abuse blocking boun...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, combined with persistent user-environment and launcher writes. The package therefore meets the install-h...

The package has a concrete, automatic postinstall mutation of a global Claude Code skill directory and forcibly replaces its contents. This meets the install-control-surface blocking poli...

The automatic postinstall chain mutates Claude Code's control surface and installs an external plugin during npm installation. This is concrete unconsented install-hook abuse.

The automatic postinstall mutation of the consumer project's Claude skill directory meets the install-control-surface block policy. The absence of network activity does not neutralize the...

Automatic postinstall writes agent skills into the consuming project and can add remotely fetched skills. That is concrete unconsented mutation of a broad AI-agent control surface.

This is an unconsented install-time mutation of a foreign global AI-agent control surface. Integrity checks for the downloaded binary do not remove the risk created by automatic Cursor co...

This is an unconsented install-time AI-agent control-surface action implemented through an opaque remotely fetched executable. Its automatic execution and fail-open verification create a...

This is concrete, automatic post-install mutation of a consumer project's broad AI-agent control surface, combined with persistent Git-hook execution. That meets the install-control-surfa...

The package has a concrete automatic postinstall path that modifies global AI-agent configuration and establishes future command execution. This meets the install-time AI-agent control-hi...

The package performs automatic postinstall mutation of foreign, user-wide AI-agent settings and permissions. The lifecycle guard and lack of observed exfiltration do not remove the concre...

Source inspection confirms unconsented postinstall mutation of global Claude Code configuration and instructions. This meets the install-control-surface blocking policy even though no cre...

This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, including automatic command execution. The absence of demonstrated exfiltration does not neutra...

The automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion e...

This is a concrete postinstall chain that downloads opaque native code and automatically mutates AI-agent hooks/settings. It meets the install-control-surface blocking policy despite no v...

This is unconsented postinstall mutation of a broad AI-agent control surface, not merely an explicit user-invoked integration setup. The lifecycle path establishes persistent package comm...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The lifecycle hook, global writes, and agent-directing payload form a concrete install-hook abuse...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The lifecycle hook directly registers a server for both Claude Code and Codex.

The automatic postinstall hook writes global Claude Code and Codex MCP configuration and registers package-controlled executable code. This meets the install-hook abuse policy even though...