Loading npm security reports…
Mobile and Web client for Claude Code and Codex
Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/agenthub.mjsView on unpkg · L2Package source references dynamic require/import behavior.
bin/agenthub.mjsView on unpkg · L7Source writes installer persistence such as shell profile or service configuration.
dist/index.cjsView on unpkg · L15Package ships non-JavaScript build or shell helper files.
scripts/download-tools.shView on unpkgPackage ships high-entropy non-source blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkgPackage ships compressed or archive-like blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L133Package source references dynamic require/import behavior.
bin/agenthub.mjsView on unpkg · L7Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/agenthub.mjsView on unpkg · L2Source writes installer persistence such as shell profile or service configuration.
dist/index.cjsView on unpkg · L15Package ships non-JavaScript build or shell helper files.
scripts/download-tools.shView on unpkgPackage ships high-entropy non-source blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkgPackage ships compressed or archive-like blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkg