npm AI-agent policy reports, with evidence.

The package performs unconsented postinstall mutation of the consuming project's Claude Code configuration surface. Opt-outs and the absence of observed exfiltration do not remove that co...

The concrete postinstall chain writes global Claude/Codex control surfaces and registers executable lifecycle behavior. This meets the install-control-surface blocking boundary.

The automatic global replacement of an existing AI-agent command by an @codexed package is a concrete unconsented control-surface hijack. No exfiltration was found, but it is not required...

This is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces. The lack of observed network exfiltration does not mitigate the persistent control-surface...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Explicit later setup and trust-review guidance does not mitigate the...

Source confirms an install-time overwrite of the global `codex` command, a broad AI-agent control surface. No separate exfiltration is required for this concrete command-hijacking chain.

The postinstall creates persistent global Codex configuration and a notify execution path without an explicit user setup command. Conditional detection and some preservation guards do not...

This is a concrete, automatic postinstall write into a foreign project-level AI-agent control surface. Although no exfiltration or remote execution was found, the lifecycle mutation meets...

The install hook deliberately overwrites an existing global AI-agent command rather than relying on npm's normal bin linking. That is a concrete unconsented control-surface hijack.

This meets the blocking policy: a postinstall hook automatically mutates detected third-party AI-client MCP configurations. Remote executable installation and persistent LaunchAgent setup...

The package performs an unconsented postinstall mutation of foreign AI-agent configuration and defines a default agent routed through its relay. The global-install guard limits exposure b...

The automatic postinstall mutates foreign/broad AI-agent control surfaces and host configuration, meeting the blocking policy. Opt-outs and global-install gating do not establish consent.

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, which meets the blocking policy. The global-install guard and opt-outs do not restore inform...

This is a concrete npm postinstall mutation of broad, foreign AI-agent configuration surfaces, including an executable Codex notify hook. The inspected runtime LLM networking is not neede...

Concrete postinstall writes target global Claude and detected Codex control surfaces rather than a package-owned directory. This meets the firewall block policy for unconsented install-ti...

Source confirms the concrete postinstall control-surface mutation. The .claude-exists check is not a package-ownership or explicit-consent gate.

The package has a concrete install-time mutation of a broad, foreign AI-agent control surface. Its conditional guard does not provide meaningful consent for the configuration change.

This is concrete, unconsented postinstall mutation of project AI-agent control surfaces, including automatic installation of third-party plugins. The lack of observed credential theft doe...

Concrete postinstall-triggered writes alter broad, foreign AI-agent configuration and shell startup surfaces. The absence of a hardcoded receiver does not mitigate the unconsented control...

The install hook performs a destructive, automatic replacement of the global `codex` launcher rather than relying on the package manager's normal bin linking. This meets the install-time...

The package performs unconsented postinstall persistence in global Claude Code settings, configuring broad lifecycle hooks that execute other binaries. This meets the install-time AI-agen...