Loading npm security reports…
Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification
LPM flags this version as an AI-agent control-surface risk. npm installation silently modifies the user's Claude Code command/control surface. It drops a slash command and supporting runtime under ~/.claude and locks most files read-only.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L9This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/postinstall.jsView on unpkgPackage source references dynamic require/import behavior.
scripts/postinstall.jsView on unpkg · L3Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L6Package source references dynamic require/import behavior.
scripts/postinstall.jsView on unpkg · L3Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L9This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/postinstall.jsView on unpkg