npm AI-agent policy reports, with evidence.

The source confirms an automatic postinstall overwrite of a foreign Pi coding-agent host, expanding its extension API. This is a concrete unconsented AI-agent control-surface mutation.

The package's declared feature does not justify silently installing and activating code in the separate DeepSeek Harness control plane during npm postinstall. This meets the blocking poli...

The package has a concrete lifecycle-triggered AI-agent control-surface mutation chain, including remote-sourced content. This meets the block boundary despite no observed credential exfi...

The automatic postinstall mutates broad, foreign AI-agent control surfaces and can introduce remotely refreshed instructions. This meets the block boundary regardless of otherwise legitim...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, including remotely refreshed instruction content. It meets the firewall block boundary despit...

The lifecycle hook performs both remote content acquisition and broad global AI-agent configuration writes without an explicit setup command. This satisfies the install-time foreign/broad...

The install-time replacement of a broadly named Codex launcher is a concrete unconsented AI-agent control-surface mutation. No network or credential theft was found, but the launcher hija...

The source establishes a concrete automatic persistence and configuration-mutation chain in an upstream Grok home, not merely a scanner signature. Lack of direct exfiltration does not mit...

Concrete postinstall mutation of ~/.cursor/skills and ~/.cursor/mcp.json meets the block boundary for unconsented foreign AI-agent control-surface writes. Checksum validation does not mit...

Direct source inspection confirms unconsented postinstall mutation of global Claude and Codex controls, including executable lifecycle configuration. This meets the blocking policy regard...

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Source inspection confirms an automatic postinstall chain that modifies global Claude/Codex configuration and registers a Node notify hook. This meets the blocking policy for unconsented...

Source inspection confirms install-time replacement of the global `codex` command rather than ordinary package-local setup. No exfiltration was found, but the concrete CLI hijack meets th...

The automatic postinstall writes a persistent Claude Desktop MCP command without user invocation or consent. This meets the install-control-surface blocking criterion regardless of the pa...

Source confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking poli...

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface...

Source inspection confirms the policy-defined blocking behavior: unconsented postinstall mutation of global Claude Code and Codex MCP configuration. The explicit CLI-only hook installer d...

The package has a concrete postinstall chain that mutates foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface...

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface w...

Source directly implements covert profile collection and account sweeping, coupled to permission-bypassing AI-agent command execution and platform synchronization. Absence of npm lifecycl...