npm AI-agent policy reports, with evidence.

The automatic postinstall performs unconsented, multi-platform AI-agent control-surface mutation and can start a project migration. This meets the install-hook abuse blocking policy even...

This package has a concrete automatic install-time chain that modifies a foreign agent's authentication controls. Its launcher additionally defaults the agent to unrestricted permissions,...

The automatic lifecycle hook mutates a foreign AI-agent control surface and deploys publisher-controlled remote content into the consumer workspace. This is a concrete unconsented install...

This is an unconsented postinstall mutation of a foreign AI-agent control surface in the consumer workspace. Its ownership and conflict checks do not remove the risk from creating that su...

This is unconsented postinstall mutation of a consumer project's AI-agent control surface and broader repository workflow. The guards are scoped to detected Suppa projects, but that does...

The package performs automatic postinstall rewrites of foreign agent authentication and permission controls, then activates unrestricted operation through its launcher. This meets the ins...

The package automatically installs package-authored agent instructions into two unrelated default agent homes and modifies them on every install. This meets the install-time foreign/broad...

The package performs broad user-level AI-agent configuration and capability installation automatically from postinstall. This meets the install-control-surface blocking policy despite no...

This is an unconsented postinstall mutation of a broad foreign AI-agent control surface. The global command registration is persistent and applies beyond the installing project.

The automatic postinstall hook mutates Claude CLI configuration outside the package-owned directory. Under the install-control-surface policy, this is concrete malicious install-hook abus...

The install hook directly patches foreign DSH authentication and sandbox-policy source rather than limiting itself to package-owned setup. This meets the install-time AI-agent control-sur...

The automatic postinstall chain makes broad changes to a consumer project's AI-agent control surface and development configuration. The safeguards limit targets but do not provide consent...

The automatic postinstall hook modifies both Codex and Claude user configuration surfaces and adds user-level dependencies. This is concrete install-hook abuse rather than an explicit use...

The package has a conditional automatic install hook that rewrites foreign AI-agent authentication and sandbox controls. This creates a concrete agent-control compromise even though no da...

The package has a concrete automatic lifecycle path that mutates consumer AI-agent control surfaces and configures execution of another package. This meets the install-control-surface blo...

The automatic postinstall hook mutates a user-wide OpenCode tool control surface by installing agent-callable code. This is a concrete install-hook abuse despite the absence of network ex...

This package performs automatic postinstall mutation of foreign AI-agent components and includes a path that weakens their sandbox and permission defaults. That meets the install-hook con...

The automatic postinstall chain mutates broad, foreign AI-agent control surfaces and launches persistent background indexing. This meets the install-hook abuse blocking policy even though...

The postinstall hook overwrites a global Pi agent instruction file rather than performing an explicit user-invoked setup. This meets the install-time AI-agent control-surface mutation blo...

The automatic postinstall path performs broad, unconsented mutation of foreign AI-agent control surfaces and installs persistent command hooks. This meets the install-hook abuse policy ev...

The automatic lifecycle hook installs a package-authored AI-agent control framework into and prunes the consumer project. Although the inspected path has no network or credential theft be...