npm AI-agent policy reports, with evidence.

The automatic postinstall changes a consumer project's AI-agent plugin surface and refreshes remote plugin content. This is a concrete unconsented install-hook control-surface mutation.

Automatic installation changes the consumer project and injects agent-review controls that hide its own generated artifacts. This is concrete install-hook abuse, not a user-invoked setup...

This is an unconsented install-time mutation of a consumer AI control surface that captures and transmits application LLM content. The behavior is concrete and automatically reachable fro...

The postinstall hook automatically and destructively installs a skill across multiple unrelated AI-agent directories. This meets the install-control-surface blocking policy despite no obs...

The postinstall hook mutates both Codex and Claude user skill directories and prunes their contents without a user-invoked setup action. This meets the install-time foreign AI-agent contr...

The package has a concrete automatic postinstall chain that broadly mutates foreign AI-agent skill directories. Its apparent product purpose does not establish consent for this install-ti...

This is an unconsented install-time mutation of a foreign AI-agent control surface with a wildcard command hook. It meets the install-hook abuse blocking policy even without proving exter...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces, with destructive replacement and persistent plugin activation. The automatic self-update path incr...

The automatic lifecycle hook mutates a foreign AI-agent control surface and multiple persistent user locations. This is concrete unconsented install-time control-surface behavior, despite...

The automatic postinstall writes package-controlled instructions into a global AI-agent command directory and refreshes them on upgrade. This meets the install-hook abuse policy regardles...

The automatic lifecycle hook changes consumer-project agent instructions rather than limiting setup to an explicit user command. This meets the install-control-surface blocking policy.

The package performs automatic postinstall mutation of both Codex and Claude skill directories, which is a foreign and broad AI-agent control surface. It also installs Python dependencies...

The automatic postinstall reaches persistent global Codex and Claude guidance writes with no interactive approval. This matches the install-control-surface block policy despite no evidenc...

The package uses an automatic npm lifecycle hook to overwrite instruction-bearing skill directories for multiple AI-agent hosts. The global-install guard reduces scope but does not provid...

The automatic postinstall hook alters global Claude and Codex MCP configuration, which is a concrete unconsented AI-agent control-surface write. This meets the install-hook abuse blocking...

The package performs unconsented postinstall mutation of foreign, broad AI-agent configuration files. That concrete automatic control-surface change meets the publish-block policy even wi...

The automatic lifecycle hook modifies a broad, foreign AI-agent control surface and installs code triggered by normal agent activity. The setup-state guard does not provide contemporaneou...

The package uses an automatic postinstall hook to mutate multiple foreign AI-agent control surfaces and install event-triggered commands. This is concrete unconsented install-time control...

The automatic postinstall hook modifies a consumer-owned Claude Code configuration and installs package command execution for all tool calls. This meets the install-control-surface publis...

This is an unconsented postinstall mutation of a foreign, global AI-agent control surface. The automatic global command registration warrants blocking even without confirmed exfiltration.

The package has an automatic postinstall path that writes package-controlled content into multiple foreign global AI-agent configuration surfaces. This meets the install-hook abuse policy...