Loading npm security reports…
Install and launch the 0xCopilot desktop app from your terminal — no DMG, no installer.
Explicit `copilot` execution can stage a large local runtime and launch it. No unconsented install-time execution or confirmed credential-exfiltration path was found.
Package source references dynamic require/import behavior.
payload/desktop/out/preload/bridge.jsView on unpkg · L8Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/paths.mjsView on unpkg · L140Package ships non-JavaScript build or shell helper files.
payload/packages/service-contracts/src/copilot_service_contracts/scopes.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
payload/packages/audit-chain/tests/test_signer.pyView on unpkgPackage contains source files above the static scanner size ceiling.
payload/desktop/out/renderer/bootstrap.jsView on unpkgPackage source references dynamic require/import behavior.
payload/desktop/out/preload/bridge.jsView on unpkg · L8Package ships non-JavaScript build or shell helper files.
payload/packages/service-contracts/src/copilot_service_contracts/scopes.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
payload/packages/audit-chain/tests/test_signer.pyView on unpkgPackage contains source files above the static scanner size ceiling.
payload/desktop/out/renderer/bootstrap.jsView on unpkgPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/paths.mjsView on unpkg · L140