Loading npm security reports…
Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically patches source files in the package's OMP dependency. No confirmed credential, network, or remote-code attack surface was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs a post-install script automatically.
package.jsonView on unpkg · L13Package ships non-JavaScript build or shell helper files.
plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
plugins/devflow-intel/extensions/devflow-intel.tsView on unpkgThe script targets a fixed OMP dependency source path and rejects an unsupported fixed-version layout.
bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L11The post-install script replaces matched dependency source text, creating an install-time mutation risk.
bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L50This report applies to @guanlin4924/devflow-pi@0.1.92.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L13The package runs a post-install script automatically.
package.jsonView on unpkg · L13Package ships non-JavaScript build or shell helper files.
plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
plugins/devflow-intel/extensions/devflow-intel.tsView on unpkgThe script targets a fixed OMP dependency source path and rejects an unsupported fixed-version layout.
bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L11The post-install script replaces matched dependency source text, creating an install-time mutation risk.
bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L50