Loading npm security reports…
观远 BI 指标写操作工具 - 指标创建编辑删除、指标目录、公共维度、Excel 标准化
LPM treats this as warn-only first-party agent extension lifecycle risk. A global-install postinstall hook automatically installs an AI skill and copies it into two assistant configuration locations. No credential theft, data exfiltration, or destructive behavior was identified in the inspected scripts.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package registers a postinstall hook that launches bin/postinstall.js.
package.jsonView on unpkg · L5Package ships native binary artifacts.
binaries/guanmetric-darwin-arm64View on unpkgThe hook runs only for global, non-CI installs unless an opt-out environment flag is set, then invokes install-skill.
bin/postinstall.jsView on unpkg · L36The install-skill path non-interactively invokes npx skills add with global-install flags.
bin/run.jsView on unpkg · L118This report applies to @guandata/guanmetric@0.1.17.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9The package registers a postinstall hook that launches bin/postinstall.js.
package.jsonView on unpkg · L5Package ships native binary artifacts.
binaries/guanmetric-darwin-arm64View on unpkgThe hook runs only for global, non-CI installs unless an opt-out environment flag is set, then invokes install-skill.
bin/postinstall.jsView on unpkg · L36The install-skill path non-interactively invokes npx skills add with global-install flags.
bin/run.jsView on unpkg · L118