Loading npm security reports…
Version control for agent sessions — the agit CLI plus skills/hooks/MCP wiring for Claude Code, Codex, OpenCode and Cursor. The AgentGit hub deploys separately.
LPM treats this as warn-only first-party agent extension lifecycle risk. An installation lifecycle hook launches an opaque platform binary and requests setup automatically. No confirmed malicious payload or exfiltration was established from the inspected source.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package registers a postinstall lifecycle hook.
package.jsonView on unpkg · L39This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
npm/lib/reconcile.jsView on unpkgThe launcher can start a detached reconciliation worker after command use.
npm/lib/reconcile.jsView on unpkg · L37The postinstall hook automatically invokes the platform binary's setup command unless an environment opt-out is set.
npm/postinstall.jsView on unpkg · L72This report applies to @einsia/agent-git@0.2.12.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L40Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L40The package registers a postinstall lifecycle hook.
package.jsonView on unpkg · L39The launcher can start a detached reconciliation worker after command use.
npm/lib/reconcile.jsView on unpkg · L37This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
npm/lib/reconcile.jsView on unpkgThe postinstall hook automatically invokes the platform binary's setup command unless an environment opt-out is set.
npm/postinstall.jsView on unpkg · L72