Loading npm security reports…
Bring Grok into your terminal
LPM flags this version as an AI-agent control-surface risk. Installing this package automatically replaces the user's Grok executable and modifies its configuration under the Grok home directory. It is a different package from the official package named in its README.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe package runs a post-install script automatically.
package.jsonView on unpkg · L21Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/postinstall.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/postinstall.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/grok-bootstrap.jsView on unpkgThis report applies to @kingingwang/grok@1.0.24-148c55c7.
See version security history for other recorded verdicts.
Evidence last updated: .
The installer extracts an executable from a platform dependency into the user's Grok directory and replaces the Grok command.
bin/postinstall.jsView on unpkg · L215Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L22Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L22The package runs a post-install script automatically.
package.jsonView on unpkg · L21A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/grok-bootstrap.jsView on unpkgThe installer extracts an executable from a platform dependency into the user's Grok directory and replaces the Grok command.
bin/postinstall.jsView on unpkg · L215Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/postinstall.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/postinstall.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/postinstall.jsView on unpkg