Loading npm security reports…
@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).
LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code mutates a consumer project's generic MCP configuration without an explicit command. This registers an agent extension that invokes a separate package through npx.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/_agent-setup.mjsView on unpkg · L6Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L360Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L360Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/_agent-setup.mjsView on unpkg · L6