npm AI-agent policy reports, with evidence.

Source inspection confirms an unconsented postinstall mutation of a foreign AI-agent control surface. The global-install and existing-Cursor guards reduce scope but do not make the mutati...

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limi...

Source inspection confirms automatic postinstall-driven global mutation of ~/.claude. That meets the firewall block boundary even though no exfiltration or remote payload execution was fo...

The install lifecycle performs unconsented global AI-agent control-surface mutation. This meets the blocking policy even though the lifecycle script itself does not make network requests.

The package has a concrete, automatic postinstall path that creates consumer-project AI instruction files. Non-overwrite safeguards do not remove the unconsented control-surface mutation.

This is concrete, unconsented postinstall mutation of a foreign, broad AI-agent control surface, not merely an explicit CLI setup flow. The lifecycle persistence meets the block policy de...

This is a concrete install-time mutation of generic, foreign AI-agent instruction files, which meets the blocking policy regardless of the absence of data exfiltration.

The lifecycle hook performs concrete, automatic writes outside the package, including broad AI-agent instruction files and consumer build commands. That meets the blocking policy even tho...

The lifecycle hook performs unconsented postinstall writes to foreign/broad AI-agent skill directories, meeting the blocking policy. The absence of visible exfiltration does not mitigate...

This is a concrete unconsented postinstall mutation of the broad Codex skill control surface. The absence of immediate exfiltration does not remove the persistence and agent-control risk.

The lifecycle behavior is concrete and directly mutates broad, third-party AI-agent configuration and prompt-extension locations without consent. Safety checks and lack of observed exfilt...

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, which meets the blocking policy. No network exfiltration was found in the inspected JavaSc...

Source directly confirms unconsented postinstall mutation of broad third-party AI-agent configurations, coupled with remote executable delivery and persistence. This meets the blocking po...

The confirmed postinstall deletion of foreign Codex and Claude runtime dependencies meets the install-time AI-agent control-surface mutation block boundary. Scanner claims about runtime e...

The behavior is transparent and no exfiltration was found, but the package automatically persists execution hooks in Claude Code during installation. This meets the block policy for uncon...

The package performs an unconsented postinstall mutation of the user's Claude Code settings, a foreign AI-agent control surface. Its stated keyboard-notification purpose and lack of netwo...

Direct source inspection confirms an unconsented postinstall mutation of six foreign AI-agent skill surfaces. This meets the firewall block threshold regardless of the CLI’s stated music...

The lifecycle script directly persists package-controlled skills and an MCP launcher in third-party Claude user configuration without an explicit user command. This meets the install-time...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. The hardening of some OpenCode rules does not remove the auto...

Source confirms an unconsented postinstall write to foreign project-root AI-agent control files. This meets the install-control-surface publish-block boundary even though no exfiltration...

The package has a concrete unconsented postinstall chain that persistently mutates broad, cross-vendor AI-agent control surfaces. This meets the install-control-surface block boundary des...