Loading npm security reports…
MCP security scanner and CI gate. Test, secure, and monitor MCP servers with attack simulation, schema drift detection, health scoring, and SARIF before agents depend on them.
LPM treats this as warn-only first-party agent extension lifecycle risk. The postinstall hook can add a scheduled GitHub Actions workflow to an MCP project, but only after explicit auto-setup configuration or an environment flag. No unconsented agent-control mutation or exfiltration was established.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/src/ci-issue.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/src/commands/demo.jsView on unpkg · L12Package source invokes a package manager install command at runtime.
dist/src/commands/test.jsView on unpkg · L242Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/skill-scan.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/commands/helpers.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/risk-graph.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/attack-sim.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/runtime-profile.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L101Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L101Package source references child process execution.
dist/src/ci-issue.jsView on unpkg · L1Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/skill-scan.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/commands/helpers.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/risk-graph.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/attack-sim.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/checks/runtime-profile.jsView on unpkgPackage source references dynamic require/import behavior.
dist/src/commands/demo.jsView on unpkg · L12Package source invokes a package manager install command at runtime.
dist/src/commands/test.jsView on unpkg · L242