Loading npm security reports…
Open a Claude Code multi-pane terminal workspace with one command (macOS only)
LPM treats this as warn-only first-party agent extension lifecycle risk. During npm postinstall, the package executes its bundled native program and requests an asset sync under the installing user. Source states that this sync writes Claude-related configuration and prompt directories, but its exact native behavior cannot be source-audited.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package automatically runs a postinstall script.
package.jsonView on unpkg · L28Package ships native binary artifacts.
libexec/claudespace.dist/unicodedata.soView on unpkgPackage ships non-JavaScript build or shell helper files.
bin/claudespace-observe.shView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/claudespace-ask.shView on unpkgThis report applies to @ayorcodes/claudespace@0.8.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L29Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29The package automatically runs a postinstall script.
package.jsonView on unpkg · L28Package ships native binary artifacts.
libexec/claudespace.dist/unicodedata.soView on unpkgPackage ships non-JavaScript build or shell helper files.
bin/claudespace-observe.shView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/claudespace-ask.shView on unpkg