Loading npm security reports…
Portable LemonClaw CLI launcher for WorkBuddy.
On npm install, the package obtains a remote runtime manifest, downloads its Python archive, extracts it under the user home, and runs its Python executable for a smoke test. The remote manifest is host-restricted but not cryptographically pinned by the package.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPostinstall automatically bootstraps a remote runtime unless an opt-out variable is set.
dist/postinstall.cjsView on unpkg · L5117Remote manifest supplies the archive URL and its accepted SHA-256; it is restricted by host, not a signed pinned manifest.
dist/postinstall.cjsView on unpkg · L3862Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L16Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L16Remote manifest supplies the archive URL and its accepted SHA-256; it is restricted by host, not a signed pinned manifest.
dist/postinstall.cjsView on unpkg · L3862Postinstall automatically bootstraps a remote runtime unless an opt-out variable is set.
dist/postinstall.cjsView on unpkg · L5117