Loading npm security reports…
系统级 mailbox/hub 同步 daemon (Node)
A user-invoked CLI starts a local LLM proxy, forwards requests to configured upstreams, and writes optional trace material locally. No install-time execution or confirmed unconsented exfiltration was established.
Package source references dynamic require/import behavior.
dist/llm/upstream.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/llm/traceEnvelope.jsView on unpkg · L1Several runtime modules are heavily obfuscated, impairing auditability.
dist/llm/traceEnvelope.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/router/sseScan.jsView on unpkgThis report applies to @evomap/evolver-proxy@2.0.16.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
dist/llm/upstream.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/router/sseScan.jsView on unpkgSource contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/llm/traceEnvelope.jsView on unpkg · L1Several runtime modules are heavily obfuscated, impairing auditability.
dist/llm/traceEnvelope.jsView on unpkg · L1