npm AI-agent policy reports, with evidence.

The package has no install hook, but its normal runtime path performs broad, remote-updatable AI-agent control-surface mutation and executes a detached downloaded native runner. This is a...

The documented postinstall path automatically installs hooks across existing Claude Code/Codex environments, an unconsented foreign AI-agent control-surface mutation. Disclosure, opt-out...

Source confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the firewall block boundary despite the absence of observed network exfiltration. P...

The package has a concrete npm postinstall path that can mutate foreign Claude control files without affirmative consent. This meets the install-control-surface block policy despite the f...

Source inspection confirms the lifecycle script deploys package-controlled instructions across multiple unrelated agent platforms. This satisfies the firewall block criterion for unconsen...

Source confirms an automatic postinstall modifies foreign global Claude/Codex configuration and installs a future Codex lifecycle hook. This meets the blocking policy for unconsented inst...

Direct source inspection confirms install-time global AI-agent configuration changes, including a default agent routing profile. The global-only guard and loopback endpoint reduce unrelat...

The package's documented purpose does not change that npm postinstall performs unconsented writes across a broad set of foreign AI-agent configurations. This meets the blocking policy for...

The confirmed postinstall behavior is unconsented mutation of foreign AI-agent configuration, meeting the blocking policy. No additional exfiltration is needed for this verdict.

Source confirms unconsented install-time mutation of Codex's global provider and default-agent control surface. That concrete behavior meets the blocking policy despite the loopback endpo...

This is a concrete, unconsented postinstall mutation of a broad foreign AI-agent control surface. The declared feature does not remove the installation-time control-hijack risk.

The package has a concrete unconsented postinstall chain that alters broad AI-agent configuration, including the default Codex agent. Its otherwise package-aligned proxy behavior does not...

The package has a concrete postinstall persistence mechanism targeting ~/.codex/skills, not merely an explicit CLI setup command. Disclosure and an opt-out do not remove the unconsented l...

This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unaut...

The concrete postinstall behavior meets the block boundary: unconsented mutation of foreign/broad AI-agent control surfaces. The absence of direct exfiltration does not mitigate this inst...

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfil...

Source inspection confirms concrete unconsented postinstall deletion and replacement of host AI-agent-related configuration. This meets the blocking policy regardless of the absence of co...

This is a concrete unconsented postinstall mutation of broad, cross-vendor AI-agent control files in the consuming project. It meets the install-control-surface block boundary despite no...

This is a concrete unconsented postinstall mutation of multiple foreign, global AI-agent control surfaces. Hardened permission defaults do not remove the install-time control-surface take...

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces. This meets the publish-block policy regardless of the absence of exfiltration.

Source confirms an automatic postinstall path that mutates multiple third-party AI-client configurations and establishes remote native-code execution with login persistence. This meets th...