Loading npm security reports…
Ferry — GitHub Actions–native agent pipeline for Jira-driven automated development
LPM treats this as warn-only first-party agent extension lifecycle risk. This is an explicitly installed autonomous development pipeline, not an install-time payload. After interactive setup, its GitHub Actions agents can send repository context to configured LLM/MCP services and modify, push, and merge repository changes.
Package source references child process execution.
dist/cli/init/index.jsView on unpkg · L3This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/agent/run.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli/agent/run.jsView on unpkg · L6526Source exposes local file and command tools to a remote model endpoint.
dist/cli/agent/run.jsView on unpkg · L289Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/local/index.jsView on unpkg · L374Package source references child process execution.
dist/cli/init/index.jsView on unpkg · L3Source exposes local file and command tools to a remote model endpoint.
dist/cli/agent/run.jsView on unpkg · L289A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli/agent/run.jsView on unpkg · L6526This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/agent/run.jsView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/local/index.jsView on unpkg · L374