Loading npm security reports…
观远 ETL 本地开发工具 - 拉取、编辑、导出、预览、保存 ETL
LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically changes foreign AI-agent skill directories without an explicit setup command. The installation helper also removes a safe-delete preload.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe npm postinstall hook activates an automatic skill installer.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgGlobal installs outside CI invoke install-skill unless an environment variable disables it.
bin/postinstall.jsView on unpkg · L24Global installs outside CI invoke install-skill unless an environment variable disables it.
bin/postinstall.jsView on unpkg · L37This report applies to @guandata/guanetl@0.1.30.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9The npm postinstall hook activates an automatic skill installer.
package.jsonView on unpkg · L9Global installs outside CI invoke install-skill unless an environment variable disables it.
bin/postinstall.jsView on unpkg · L24Global installs outside CI invoke install-skill unless an environment variable disables it.
bin/postinstall.jsView on unpkg · L37