Loading npm security reports…
AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 36 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/chunk-QPTSA4PP.jsView on unpkg · L19Source file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.mjsView on unpkgPackage source references dynamic require/import behavior.
dist/chunk-FHIFTSPL.jsView on unpkg · L92Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-5V7BD7Z4.jsView on unpkgSource writes installer persistence such as shell profile or service configuration.
dist/chunk-5V7BD7Z4.jsView on unpkg · L12A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/project-boot-VEYFCCSL.jsView on unpkg · L13Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/project-boot-VEYFCCSL.jsView on unpkgSource downloads or fetches remote code and executes it.
dist/bin/install.jsView on unpkg · L251A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin/install.jsView on unpkg · L251A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/bin/install.jsView on unpkg · L251Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/installer-SRJGE4GU.jsView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/bin/deferred-daemon-restart.jsView on unpkg · L208Package source invokes a package manager install command at runtime.
dist/bin/update.jsView on unpkg · L154Package ships non-JavaScript build or shell helper files.
dist/bin/exe-start.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
deploy/compose/generate-env.ts#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-3XY57PKT.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/codex-reviewd-cli.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-agent.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-launch-agent.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-start-codex.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-ZOTTYCP5.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-start-opencode.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/reconcile-backlog.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-2SRG3B3D.jsView on unpkgThis report applies to @askexenow/exe-os@0.9.384.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L127Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L127Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/installer-SRJGE4GU.jsView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/bin/deferred-daemon-restart.jsView on unpkg · L208Package source invokes a package manager install command at runtime.
dist/bin/update.jsView on unpkg · L154Package ships non-JavaScript build or shell helper files.
dist/bin/exe-start.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
deploy/compose/generate-env.ts#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-3XY57PKT.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/codex-reviewd-cli.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-agent.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-launch-agent.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-start-codex.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-ZOTTYCP5.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/exe-start-opencode.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bin/reconcile-backlog.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-2SRG3B3D.jsView on unpkgPackage source references child process execution.
dist/chunk-QPTSA4PP.jsView on unpkg · L19Package source references shell execution.
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.mjsView on unpkgPackage source references dynamic require/import behavior.
dist/chunk-FHIFTSPL.jsView on unpkg · L92Source writes installer persistence such as shell profile or service configuration.
dist/chunk-5V7BD7Z4.jsView on unpkg · L12Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-5V7BD7Z4.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/project-boot-VEYFCCSL.jsView on unpkg · L13Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/project-boot-VEYFCCSL.jsView on unpkgSource downloads or fetches remote code and executes it.
dist/bin/install.jsView on unpkg · L251A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin/install.jsView on unpkg · L251A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/bin/install.jsView on unpkg · L251