npm AI-agent policy reports, with evidence.

Source proves automatic, unconsented replacement of a command in global Claude settings during npm postinstall. This meets the specified blocking rule even though the command has a packag...

Source establishes unconsented postinstall mutation of a broad AI-agent control surface, meeting the supplied blocking policy. The mutation enables content telemetry globally rather than...

The postinstall hook performs a global Claude configuration change that activates content telemetry to a package-controlled endpoint. The opt-out does not provide prior interactive consen...

The package uses postinstall to alter a broad AI-agent control surface and enable export of Claude session content to its endpoint. This is concrete unconsented install-time agent configu...

This is an unconsented postinstall mutation of a broad AI-agent configuration that enables export of sensitive Claude Code content. The opt-out does not make the automatic default behavio...

This is unconsented postinstall mutation of a broad AI-agent control surface that enables export of sensitive interaction telemetry. The behavior is active by default and is sufficient to...

The automatic global postinstall path modifies external agent configuration and disables a named safety preload for its child process. Those concrete behaviors meet the install-control-su...

Automatic postinstall execution of a remotely selected binary followed by AI-tool onboarding is a concrete unconsented install-time control-surface risk. The opt-out is not an affirmative...

The package performs automatic installation-time execution of a remotely supplied binary and invokes AI-tool onboarding by default. That is a concrete unconsented AI-agent control-surface...

An install-time hook executes an opaque, remotely selected binary command advertised as connecting AI tools. This is an unconsented lifecycle path to a broad AI-agent control surface.

The package has an automatic postinstall path that mutates foreign AI-agent dependency code. This meets the install-time foreign control-surface mutation block condition.

The package uses postinstall to inject agent-directed guidance into consumer projects without an explicit user command. This is concrete install-hook abuse affecting AI-agent behavior.

The automatic post-install mutation of foreign AI-agent runtime code meets the blocking policy. Its narrow scope reduces uncertainty but does not establish consent for the dependency rewr...

The automatic lifecycle hook executes an opaque downloaded or bundled binary specifically to alter Codex and Claude Code integration. This is a concrete install-time AI-agent control-surf...

An npm post-install hook automatically executes opaque native code to install AI-agent hooks. This is an unconsented install-time mutation of a foreign AI-agent control surface.

The automatic post-install mutation of Claude Code hooks is an unconsented modification of a broad AI-agent control surface. This meets the install-control-surface block policy.

The package establishes an automatic lifecycle chain from npm installation to an opaque binary's agent-hook installer. This is concrete install-time AI-agent control-surface mutation and...

The automatic lifecycle hook performs unconsented installation and configuration of a broad DSH AI-agent control surface. This meets the install-control-surface blocking boundary even wit...

The automatic post-install hook writes to a consumer-owned AI-agent control file, meeting the policy threshold for unconsented lifecycle mutation of a foreign control surface. No addition...

The package contains a concrete postinstall path that force-registers an agent skill in the user's global Muse scope. This is unconsented lifecycle mutation of a broad AI-agent control su...

This is concrete install-hook abuse: an automatic npm lifecycle hook changes multiple unrelated AI-agent configurations and installs a session-controlling plugin. The conditional director...