npm AI-agent policy reports, with evidence.

This is a concrete install-time AI-agent control-surface hijack, not merely an explicit setup command. The lifecycle hook suppresses output while creating persistent cross-agent configura...

The source establishes a concrete install-time chain from npm postinstall to foreign Herdr plugin deployment and detached execution. This meets the install-control-surface block condition...

The lifecycle hook performs unconsented global installation of a foreign AI-agent CLI, which is a concrete install-time control-surface mutation. Benign desktop-shell functionality does n...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and weakens approval/intercepts tool use. This meets the block boundary even without conf...

The lifecycle hook performs the exact unconsented broad AI-agent configuration mutation reserved for blocking. The setup is package-owned but crosses multiple external agent configuration...

The automatic postinstall writes and activates a third-party Herdr plugin surface; this meets the install-control-surface block boundary. No lifecycle network exfiltration was found, but...

The package’s postinstall automatically modifies detected Claude Code and Codex hook configuration. This meets the blocking policy for unconsented install-time mutation of foreign AI-agen...

The source confirms install-time mutation of multiple foreign AI-agent skill locations. The global-install guard reduces reach but does not make the mutation consensual. Product guard nor...

The postinstall lifecycle hook performs unconsented mutation of broad, foreign AI-agent control surfaces and installs a remote dependency. This meets the blocking policy regardless of the...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the install-control-surface block policy even though no install-time network...

The package performs an unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. Registry-only update checking and credential filtering do not mitigate that inst...

The postinstall hook concretely injects MCP launch configuration into multiple third-party editor directories under the consumer project. This meets the install-time foreign/broad AI-agen...

The package’s install hook performs concrete writes to detected third-party AI-agent configuration roots rather than limiting setup to an explicit CLI command. This matches the blocking i...

The postinstall hook performs unconsented global AI-agent command installation. This meets the firewall block condition even though the visible payload is static and no network or credent...

Direct inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking policy irrespective of the absence of confirmed credential...

The package performs automatic postinstall writes into Claude Code, Codex, and opencode skill paths. This meets the firewall block boundary for unconsented install-time mutation of foreig...

This is a concrete unconsented postinstall mutation of multiple third-party AI-agent control surfaces, meeting the block boundary. The bundled native binaries are opaque but are not requi...

This is a concrete unconsented postinstall mutation of broad third-party AI-agent control surfaces combined with credential reuse and prompt exfiltration. It meets the package firewall bl...

This is concrete, lifecycle-reachable mutation of several foreign AI-agent configurations, not an explicit user setup command. The additional credential-handling and remote defaults incre...

The lifecycle hook concretely performs broad, unconsented AI-agent configuration and persistence, meeting the blocking policy regardless of the absence of a bundled remote endpoint.

The package has a concrete, automatic postinstall chain that writes a bundled skill into detected third-party agent directories. Under the firewall policy, this requires a publish block r...