npm security reports, with evidence.

Direct inspection confirms an npm postinstall mutates the foreign global Claude Code control surface and installs persistent hooks. The prior-setup guard limits reach but does not establi...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. No exfiltration is needed for this verdict.

The install hook concretely performs unconsented, broad foreign AI-agent control-surface writes. The absence of lifecycle network exfiltration does not remove this policy-defined blocking...

The package has a concrete install-time, unconsented mutation of broad foreign AI-agent control surfaces. Although no credential exfiltration or remote payload was found, this behavior me...

Concrete source shows unconsented postinstall mutation of a consuming project's package.json and Cursor rules. This meets the firewall block policy regardless of the absence of network ex...

Source inspection confirms concrete install-time OpenClaw control-surface changes and gateway exposure. The OpenClaw-presence guard does not establish user consent.

This is an unconsented postinstall mutation of a foreign AI-agent control surface and includes recursive replacement of its destination. No exfiltration is needed for this concrete contro...

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces. The lack of installer exfiltration does not mitigate the persistence and control-surface hi...

This is a concrete postinstall mutation of broad, foreign AI-agent control surfaces, compounded by automatic persistence. Safeguards and lack of observed exfiltration do not establish con...

The package’s primary assets appear package-aligned, but its automatic postinstall performs broad, active AI-agent and MCP configuration changes in every consuming project. That concrete...

The install hook performs unconsented mutation of broad, foreign AI-agent skill control surfaces. This meets the blocking policy even though the inspected installer shows no separate exfi...

Direct source inspection confirms unconsented postinstall mutation of a broad AI-agent control surface and a concrete token-bearing outbound flow. These exceed a same-vendor setup shim an...

Source directly establishes default remote telemetry and unredacted credential-bearing command arguments. This is concrete credential exfiltration, not merely a suspicious primitive.

This is concrete default credential exfiltration, not merely legitimate command telemetry: secrets accepted as CLI options are forwarded without filtering to an external analytics host. N...

The package contains a concrete, reachable default path that transmits environment-derived secret values to an external package-controlled host. Absence of an npm install hook does not mi...

Source inspection confirms unconsented postinstall mutation of a consuming project's broad AI-agent control surface plus Git-hook persistence. This meets the firewall block boundary regar...

The source establishes a concrete credential-exfiltration path in a normal documented login flow, not merely a scanner signature. Lack of lifecycle hooks does not mitigate this runtime ac...

The lifecycle hook performs concrete, unconsented replacement of broad foreign AI-agent skill locations. This meets the install-control-surface blocking boundary despite no observed insta...

Source inspection confirms the critical finding: an automatic npm lifecycle hook replaces Codex and Claude Code skill directories. Disclosure in documentation does not make this opt-in ag...

The confirmed postinstall mutation of foreign/broad AI-agent skill directories meets the blocking policy, even though no separate payload exfiltration was found.

Source confirms a default-enabled hard-coded external reporting path for locally collected Claude and development-work data. The package's own plugin setup is not independently blocking,...