Loading npm security reports…
Chrome Native-Messaging host (Node)
LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time mutation occurs because the postinstall entry imports a guarded module without executing its main routine. Explicit registration can create a package-owned Chrome Native Messaging host, and runtime agent features can invoke local AI CLIs or configured providers.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/index.jsView on unpkg · L6Source writes installer persistence such as shell profile or service configuration.
dist/scripts/utils.jsView on unpkg · L20Package ships non-JavaScript build or shell helper files.
dist/run_host.shView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/agent/engines/claude.jsView on unpkgInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg · L85Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L85Package ships non-JavaScript build or shell helper files.
dist/run_host.shView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/agent/engines/claude.jsView on unpkgPackage source references dynamic require/import behavior.
dist/index.jsView on unpkg · L6Source writes installer persistence such as shell profile or service configuration.
dist/scripts/utils.jsView on unpkg · L20