npm AI-agent policy reports, with evidence.

This package uses an automatic lifecycle hook to write instructions into several global AI-agent control surfaces without user action. That behavior meets the install-control-surface bloc...

The package performs automatic postinstall writes to global Claude Code and Codex instruction locations, including replacement of a managed AGENTS.md block. This meets the install-control...

The source establishes an automatic postinstall path that broadly mutates foreign repository and AI-agent control surfaces. The guard conditions do not convert this automatic behavior int...

The lifecycle hook performs automatic, multi-file mutation of consumer AI-agent and development controls. Guard conditions and product-oriented runtime networking do not remove the uncons...

The package's install hook automatically changes global Claude, Cursor, Copilot, and Codex control settings and enables a persistent background process. This meets the install-time AI-age...

The source establishes a complete automatic lifecycle chain from npm postinstall to global AI-agent configuration mutation, detached execution, and login persistence. That matches install...

The source confirms an automatic postinstall hook that mutates broad foreign AI-agent skill roots. Although no exfiltration or downloaded payload is present, this concrete unconsented con...

The automatic postinstall hook modifies skill discovery locations for multiple unrelated AI-agent products and can replace existing links. Although no exfiltration or network activity was...

Source inspection confirms an automatic postinstall chain that installs a foreign global AI-agent CLI and persistently changes user configuration. This meets the install-time foreign cont...

The automatic installation of a foreign AI-agent CLI and persistent user PATH mutation meet the install-time foreign control-surface policy. No self-dependency or credential exfiltration...

This is unconsented postinstall mutation of a foreign AI-agent control surface. The lack of install-time network activity does not neutralize the broad automatic overwrite behavior.

This is a concrete automatic postinstall mutation of a foreign AI-agent control surface and consumer project automation. The scope checks and opt-out reduce spread but do not provide prio...

The deliberate concealment and unconditional disabling of a foreign AI agent's permission guard are concrete harmful runtime behavior. The absence of an install hook reduces scope but doe...

The automatic postinstall path deliberately mutates a qualifying consumer project's AI-agent configuration and repository controls. Its scope checks reduce spread but do not establish con...

This is an unconsented postinstall mutation of a foreign project's AI-agent control surface and repository hooks. Guard conditions and an opt-out reduce scope but do not establish consent...

The package performs broad consumer-project and AI-agent control-surface writes during postinstall. The conditional checks do not establish user consent for those automatic changes.

The package performs unconsented postinstall replacement of skills across foreign AI-agent directories. The global-install guard and opt-out do not provide consent for this broad control-...

The install hook performs a concrete remote-content deployment into multiple third-party AI-agent directories and deletes related user state. This meets the blocking policy for unconsente...

This is concrete unconsented postinstall mutation of unrelated AI-agent skill directories, followed by injected routing behavior. The local-only and opt-out safeguards do not make the aut...

The automatic global launcher replacement is a concrete AI-agent command hijack. No exfiltration was found in the inspected JavaScript, but it is not required for the install-time control...

The automatic postinstall mutation of a foreign, user-wide AI-agent skills directory meets the install-control-surface block policy. No exfiltration was found, but it is not required for...