npm AI-agent policy reports, with evidence.

This meets the block boundary: an npm postinstall mutates a foreign host project’s AI/MCP configuration and activates a Git hook. Lack of a confirmed network exfiltration path does not re...

The lifecycle script performs unconsented postinstall mutation of the foreign, user-wide Claude Code hook surface. Its conditional binary lookup does not make the automatic persistent hoo...

Direct inspection confirms an unconditional postinstall write to a foreign, user-wide AI-agent MCP configuration. This meets the install-time agent-control-hijack block boundary.

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global Codex control-surface mutation meets the firewall block boundary.

Source confirms unconsented postinstall mutation of a consumer AI-agent control surface, not merely an explicit user setup command. This meets the blocking policy despite idempotence and...

Direct inspection confirms the package performs the policy-defined blocking behavior: npm postinstall mutates multiple foreign AI-client control surfaces without an explicit user setup co...

The postinstall hook concretely performs unconsented mutation of a consumer project's Claude skills, including destructive replacement. This meets the install-time foreign AI-agent contro...

The lifecycle hook concretely mutates multiple foreign agent skill directories without an explicit setup command or install-time consent. This meets the install-control-surface block boun...

The documented behavior is intentionally implemented, but it meets the block policy: unconsented postinstall mutation of foreign AI-agent control files and consumer build scripts. No exfi...

This is a concrete unconsented postinstall mutation of foreign, repository-level AI-agent control files. The absence of exfiltration does not remove the install-time control-surface risk.

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, which meets the blocking policy. Other observed network and hook features are not needed for the verdict.

The lifecycle chain is source-confirmed and unguarded for npm installs; its setup does not limit configuration writes to a package-owned surface. This meets the blocking policy independen...

The confirmed postinstall chain mutates a broad foreign AI-agent control surface and establishes persistence. This meets the block policy despite package-aligned loopback networking and r...

This is a concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, coupled with remote binary execution. It meets the blocking policy regardless of package...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, accompanied by persistence. Localhost binding does not remove the control-hijack risk becaus...

Source inspection confirms a concrete postinstall write into Codex's global skills directory. That behavior meets the firewall block boundary regardless of otherwise package-aligned API a...

The lifecycle behavior meets the block boundary: npm postinstall mutates multiple foreign global AI-agent control surfaces without an explicit user setup command. Lack of download/exfiltr...

The concrete install-time writes to multiple foreign global AI-agent control surfaces meet the blocking policy. Hardened OpenCode permission defaults do not remove the unconsented lifecyc...

The package’s automatic postinstall performs broad, persistent AI-agent control-surface writes outside the consuming project. This meets the blocking policy regardless of the absence of o...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The absence of observed install-time exfiltration does not remove that block-level behavior.

The automatic cross-host agent-control mutations meet the install-control-surface blocking rule. Lack of observed exfiltration does not remove that concrete install-time persistence/contr...