npm AI-agent policy reports, with evidence.

Source confirms concrete postinstall mutation of ~/.claude and ~/.codex, including Codex's default child-agent selection. That meets the block boundary for unconsented install-time mutati...

The unconditional postinstall writes to ~/.claude, which is a broad foreign AI-agent control surface. Per policy this concrete unconsented mutation warrants blocking even though the defau...

This is a concrete unconsented postinstall write to a broad AI-agent control surface. Runtime authentication and network features do not mitigate that install-time persistence.

The source confirms an unconsented postinstall mutation chain affecting foreign AI-agent control surfaces. This meets the install-control-surface block policy despite no observed exfiltra...

This is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic execution. The conditional existence check does not make the configurat...

The source directly implements cross-vendor AI-agent configuration mutation during postinstall, which meets the blocking policy regardless of the absence of visible exfiltration in the la...

This is a concrete postinstall mutation of foreign, broad AI-agent control surfaces. The absence of network exfiltration does not mitigate the unconsented persistent instruction installat...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global agent-control mutation and unpinned future executable meet the block policy.

This is concrete install-time mutation of foreign AI-agent control files, not merely interactive first-party setup. The hidden quiet path also bootstraps and executes remote code.

The install-time mutation targets a foreign, broad AI-agent control surface and is unconsented. Managed-target safeguards do not remove the initial automatic injection.

The postinstall hook performs a concrete, persistent write outside its own package into a dependency's OAuth UI. Under the install-control-surface policy, this warrants blocking despite t...

Although the bundled skill is documented and appears qgrid-specific, the postinstall hook automatically replaces foreign project and user-wide agent skill locations. That concrete install...

Source inspection confirms an unconsented postinstall modifies broad, foreign AI-agent configuration and installs persistent event hooks/extensions. This meets the install-control-surface...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, matching the block boundary. The lack of an install-time network call does not mitigate th...

The confirmed postinstall path automatically installs package-controlled agent instructions into multiple third-party/global agent directories. This meets the block policy for unconsented...

The install hook performs unconsented mutation of foreign AI-agent control files and consumer build configuration. This meets the policy boundary for a publish block despite no observed n...

The install-time, default cross-agent mutation meets the firewall block policy even though no exfiltration endpoint was confirmed. The documented behavior and installer source directly su...

This is concrete unconsented postinstall mutation of foreign, global AI-agent control surfaces. The later provider calls are not needed for the block decision.

The guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeo...

The package has legitimate relay functionality, but its global postinstall mutates foreign Codex and Claude control surfaces, including a default agent profile. This meets the block bound...

The package performs unconsented postinstall mutation of a consuming project’s broad AI-agent control surface, including deletion of existing agent configuration. This meets the firewall...