Loading npm security reports…
AgentLink local agent CLI
LPM treats this as warn-only first-party agent extension lifecycle risk. A global-install lifecycle hook can migrate an already adopted AgentLink runtime by downloading and staging a vendor bundle. Runtime operation can install AgentLink's own user-level auto-start service; this is a first-party remote-development capability, not confirmed malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references weak cryptographic algorithms.
dist/emergency-upgrade.jsView on unpkg · L4Source writes installer persistence such as shell profile or service configuration.
launcher/launcher.cjsView on unpkg · L7A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service.jsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L37Package source references weak cryptographic algorithms.
dist/emergency-upgrade.jsView on unpkg · L4Source writes installer persistence such as shell profile or service configuration.
launcher/launcher.cjsView on unpkg · L7A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service.jsView on unpkg · L1