Loading npm security reports…
Schema validation package for CXTMS YAML modules
Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage contains a possible secret pattern.
templates/workflow-ftp-edi.yamlView on unpkg · L62Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli.jsView on unpkgPackage source invokes a package manager install command at runtime.
dist/cli.jsView on unpkg · L1545Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L35Hardcoded password in templates/workflow-ftp-tracking.yaml
templates/workflow-ftp-tracking.yamlView on unpkg · L62This report applies to @cxtms/cx-schema@1.9.242.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L14Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L14Package contains a possible secret pattern.
templates/workflow-ftp-edi.yamlView on unpkg · L62Package source invokes a package manager install command at runtime.
dist/cli.jsView on unpkg · L1545Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L35Hardcoded password in templates/workflow-ftp-tracking.yaml
templates/workflow-ftp-tracking.yamlView on unpkg · L62