npm AI-agent policy reports, with evidence.

This is a concrete unconsented install-time mutation of broad foreign AI-agent control surfaces. Guardrails and lack of observed exfiltration do not remove that attack surface.

The lifecycle hook performs automatic cross-agent configuration mutation, meeting the block boundary for a foreign/broad AI-agent control surface. No exfiltration was confirmed, but it is...

The automatic lifecycle script performs destructive credential/config mutation and credential replacement in a shared AI CLI directory. Package-aligned networking does not mitigate the un...

Source confirms the critical behavior rather than merely scanner hints: an automatic npm postinstall modifies global Claude configuration and injects a mutable MCP launch command. This me...

This is a concrete unconsented postinstall mutation of broad AI-agent control files in the consumer project. The templates appear design-system-oriented and no exfiltration was found, but...

Source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. Guardrails around filesystem boundaries do not remove...

This is a concrete unconsented postinstall write to foreign project-root AI-agent instruction files. The absence of exfiltration does not remove the policy-defined control-hijack behavior.

This is a concrete, unconsented postinstall mutation of foreign AI-agent control files. Lack of exfiltration does not remove the control-surface compromise.

This is concrete unconsented postinstall mutation of foreign, global AI-agent configuration and lifecycle controls. It meets the firewall block boundary even without postinstall network a...

The lifecycle hook performs concrete, targeted destructive mutation of existing competing AI-agent configuration and replaces it with provider credentials. This meets the block boundary f...

This is unconsented postinstall mutation of an AI-agent credential/control surface, including destructive removal of existing credentials and automatic replacement with a vendor key.

Source inspection confirms unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No network exfiltration is required for this concr...

The active lifecycle hook performs destructive credential/config mutation and account provisioning outside an explicit user command. This meets the blocking policy for foreign or broad AI...

The lifecycle script performs concrete, unconsented deletion and replacement of user AI CLI credentials/configuration. Vendor-aligned networking does not mitigate that install-time contro...

The package’s stated feature is implemented through an automatic postinstall mutation of several third-party/shared AI-agent skill locations. That concrete lifecycle control-surface write...

This is a concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Localhost-only transport does not mitigate the install-time cross-agent registration.

The source confirms an unconsented postinstall write to a consumer Claude skill path. That meets the install-time foreign AI-agent control-surface mutation block boundary.

The concrete postinstall behavior satisfies the blocking policy for unconsented mutation of broad foreign AI-agent control surfaces. No network exfiltration is needed for this install-tim...

This is a concrete, unconsented postinstall takeover of a broad user-level AI-agent credential/control surface, not merely a runtime feature. The launcher itself is local, but it does not...

This is a concrete, unconsented postinstall mutation of an AI-agent credential/control surface, including destructive replacement of existing configuration. The behavior is not required t...

This is a concrete broad AI-agent control-surface takeover chain, not merely a bootstrapper: it modifies home and project instruction files and executes a remotely obtained native daemon....