Loading npm security reports…
Provider-agnostic AI coding agent for your terminal (binary distribution)
Installing the package downloads a mutable remote archive and extracts it into the package. If the archive contains the expected skills manifest, its binary is executed during installation; macOS quarantine removal weakens an OS protection.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall automatically runs an installer through npm postinstall.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe installer downloads an unpinned latest release, saves it, and extracts it without integrity verification.
install.jsView on unpkg · L22This report applies to @hipmmai/hipmmcode@1.0.10.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9Install automatically runs an installer through npm postinstall.
package.jsonView on unpkg · L8The installer downloads an unpinned latest release, saves it, and extracts it without integrity verification.
install.jsView on unpkg · L22