@agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.7
Read-only Po server payload for Linux arm64 sandbox containers, mounted at /opt/po and run with Node 24.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest contains a build script but no install hook, and the inspected runtime behavior is consistent with its container runtime role. The scanner’s incomplete analysis is not itself evidence of malicious behavior.
Decision evidence
public snapshot- package.json lists only a build script; the package exports runtime metadata and its package manifest.
- server.mjs registers session resources and tools with the agent runtime.
- backgroundSync-DDfvk95j.mjs sends OAuth token requests to OpenAI’s authentication endpoint.
- node-BHLaIwwU-EwZKJUBX.mjs reads environment settings for log sink configuration.
- run-7OS6vmrg.mjs keeps an explicitly selected home directory isolated from the process environment.
- node-BNuJntxX.mjs and testMode-Mg4Ay1V5.mjs show ordinary file matching and Po home-directory configuration.
Source & flagged code
8 flaggedThe scanner resource watchdog stopped semantic analysis before full coverage; route this package to AI without publishing a static verdict.
package.json lists only a build script; the package exports runtime metadata and its package manifest.
package.jsonView on unpkg · L36Findings
Affected versions and remediation
This report applies to @agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.7.
See all versions of @agimon-ai/po-container-runtime-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.