Loading npm security reports…
DAST MCP CLI — fixed single-server client for Flight Master aviation data
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes a DAST skill into pre-existing third-party AI-agent configuration directories. That skill instructs agents to invoke the CLI, which can send the configured API key to the DAST MCP endpoint.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe postinstall hook automatically loads an installer during npm installation.
package.jsonView on unpkg · L16The installer writes a skill into existing Cursor, Trae, Claude, and generic agent skill directories under the user's home directory.
dist/scripts/auto-install-skill.jsView on unpkg · L9This report applies to @flightmaster/dast-cli@1.0.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg · L21Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L21The postinstall hook automatically loads an installer during npm installation.
package.jsonView on unpkg · L16A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe installer writes a skill into existing Cursor, Trae, Claude, and generic agent skill directories under the user's home directory.
dist/scripts/auto-install-skill.jsView on unpkg · L9