Loading npm security reports…
@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).
LPM treats this as warn-only first-party agent extension lifecycle risk. npm install silently creates or alters the consumer's .mcp.json, registering a package-owned MCP server executed through npx. The broader Claude Code hook and instruction injection requires an explicit CLI command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/_agent-setup.mjsView on unpkg · L6Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L360Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L360Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/_agent-setup.mjsView on unpkg · L6