npm AI-agent policy reports, with evidence.

This is unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the block policy. Obfuscation and additional dependency rewriting raise confidence; no exfiltration...

Direct lifecycle source confirms broad, persistent AI-agent configuration writes at install time. This meets the blocking policy regardless of the absence of observed exfiltration.

The concrete postinstall mutation of global Claude Code configuration is sufficient for a block under the install-control-surface policy. The reviewed statusline source does not show netw...

The package performs behavior-bearing cross-agent configuration writes during postinstall without an explicit user command. This meets the install-control-surface blocking boundary despit...

The automatic lifecycle path performs broad AI-agent configuration writes in the consuming project without an explicit user command. That meets the install-control-surface block criterion...

The source confirms an automatic postinstall chain that modifies global Claude/Codex configuration and installs a Codex notify handler. This meets the block policy for unconsented install...

The package performs unconsented postinstall mutation of foreign AI-agent control surfaces and repository execution settings. This meets the blocking policy despite no observed network ex...

This is unconsented install-time mutation of an AI-agent credential/control surface, including targeted deletion of competitor-associated credentials and automatic replacement with a vend...

The install hook mutates the user-wide Grok binary and config without an explicit command, while the package's README points users to a different official scope. This is a concrete foreig...

The lifecycle hook makes persistent, unprompted changes to user shell profiles and shadows the Claude command. This meets the firewall block policy despite no observed exfiltration.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain was needed for this verdict.

The package has a concrete, manifest-reachable postinstall chain that silently registers hooks in Claude Code settings. Package-aligned telemetry does not remove the unconsented foreign A...

The package has a concrete postinstall persistence chain affecting global Claude Code settings and shell profiles. Although the inspected statusline contains no observed exfiltration, the...

The lifecycle script performs the concrete broad agent-control-surface mutation that the firewall policy reserves for blocking. Although the configuration is branded Wowok and no direct c...

Direct source inspection confirms unguarded postinstall writes to both foreign agent configurations. This meets the blocking policy regardless of the local stdio transport.

The source confirms the lifecycle mutation rather than merely indicating it statically. This meets the firewall block boundary for unconsented postinstall writes to foreign/broad AI-agent...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, which meets the firewall block policy. No separate credential-exfiltration endpoint was confirmed.

This is concrete, install-time mutation of foreign and broad AI-agent control surfaces. The absence of network exfiltration does not mitigate that policy-triggering behavior.

The concrete install-time behavior is unconsented mutation of broad foreign AI-agent control surfaces, including auto-approval policy changes. This meets the blocking boundary even though...

The confirmed lifecycle path performs unconsented install-time mutation of foreign/broad AI-agent control surfaces. The lack of observed exfiltration does not remove that concrete install...

Source confirms the lifecycle hook and automatic cross-agent skill mutation; this meets the install-control-surface block boundary. Scanner similarity labels were not relied upon.