Loading npm security reports…
观远 ETL 本地开发工具 - 拉取、编辑、导出、预览、保存 ETL
LPM treats this as warn-only first-party agent extension lifecycle risk. Global installation automatically refreshes a package-owned AI skill through an external installer and direct assistant-directory writes. This creates a guarded extension lifecycle risk; no confirmed malicious attack was established.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json automatically runs bin/postinstall.js after installation.
package.jsonView on unpkg · L9The hook invokes install-skill only for global installs, with explicit skip and CI guards.
bin/postinstall.jsView on unpkg · L24The hook invokes install-skill only for global installs, with explicit skip and CI guards.
bin/postinstall.jsView on unpkg · L37This report applies to @guandata/guanetl@0.1.36.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9package.json automatically runs bin/postinstall.js after installation.
package.jsonView on unpkg · L9The hook invokes install-skill only for global installs, with explicit skip and CI guards.
bin/postinstall.jsView on unpkg · L24The hook invokes install-skill only for global installs, with explicit skip and CI guards.
bin/postinstall.jsView on unpkg · L37