npm AI-agent policy reports, with evidence.

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global Codex control-surface mutation meets the firewall block boundary.

Source confirms unconsented postinstall mutation of a consumer AI-agent control surface, not merely an explicit user setup command. This meets the blocking policy despite idempotence and...

Direct inspection confirms the package performs the policy-defined blocking behavior: npm postinstall mutates multiple foreign AI-client control surfaces without an explicit user setup co...

The postinstall hook concretely performs unconsented mutation of a consumer project's Claude skills, including destructive replacement. This meets the install-time foreign AI-agent contro...

The lifecycle hook concretely mutates multiple foreign agent skill directories without an explicit setup command or install-time consent. This meets the install-control-surface block boun...

The documented behavior is intentionally implemented, but it meets the block policy: unconsented postinstall mutation of foreign AI-agent control files and consumer build scripts. No exfi...

This is a concrete unconsented postinstall mutation of foreign, repository-level AI-agent control files. The absence of exfiltration does not remove the install-time control-surface risk.

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, which meets the blocking policy. Other observed network and hook features are not needed for the verdict.

The lifecycle chain is source-confirmed and unguarded for npm installs; its setup does not limit configuration writes to a package-owned surface. This meets the blocking policy independen...

The confirmed postinstall chain mutates a broad foreign AI-agent control surface and establishes persistence. This meets the block policy despite package-aligned loopback networking and r...

This is a concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, coupled with remote binary execution. It meets the blocking policy regardless of package...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, accompanied by persistence. Localhost binding does not remove the control-hijack risk becaus...

Source inspection confirms a concrete postinstall write into Codex's global skills directory. That behavior meets the firewall block boundary regardless of otherwise package-aligned API a...

The lifecycle behavior meets the block boundary: npm postinstall mutates multiple foreign global AI-agent control surfaces without an explicit user setup command. Lack of download/exfiltr...

The concrete install-time writes to multiple foreign global AI-agent control surfaces meet the blocking policy. Hardened OpenCode permission defaults do not remove the unconsented lifecyc...

The package’s automatic postinstall performs broad, persistent AI-agent control-surface writes outside the consuming project. This meets the blocking policy regardless of the absence of o...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The absence of observed install-time exfiltration does not remove that block-level behavior.

The automatic cross-host agent-control mutations meet the install-control-surface blocking rule. Lack of observed exfiltration does not remove that concrete install-time persistence/contr...

Direct source inspection confirms unconsented postinstall mutation of several global AI-agent control surfaces. This meets the install-control-surface block criterion regardless of benign...

Source inspection confirms unconsented postinstall mutation of several foreign global AI-agent control surfaces, which meets the blocking policy. The token-handling runtime path further i...

The concrete postinstall mutation of broad, foreign AI-agent control surfaces meets the block boundary. Hardened OpenCode defaults and lack of observed exfiltration do not remove the unco...