Loading npm security reports…
Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgA manifest entrypoint or package-local install chain reaches persistence behavior.
packages/awb-core/src/common.jsView on unpkg · L6Source writes installer persistence such as shell profile or service configuration.
packages/awb-core/src/common.jsView on unpkg · L6Package source references weak cryptographic algorithms.
packages/awb-core/src/common.jsView on unpkg · L6Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/_shared.mjs#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
packages/awb-core/src/services.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/awb-core/src/services.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
packages/awb-core/src/update.jsView on unpkgThis report applies to @lingjingai/lj-awb-cli@0.5.17.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L32Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L32Package ships non-JavaScript build or shell helper files.
skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/_shared.mjs#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
packages/awb-core/src/services.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/awb-core/src/services.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
packages/awb-core/src/update.jsView on unpkgA manifest entrypoint or package-local install chain reaches persistence behavior.
packages/awb-core/src/common.jsView on unpkg · L6Source writes installer persistence such as shell profile or service configuration.
packages/awb-core/src/common.jsView on unpkg · L6Package source references weak cryptographic algorithms.
packages/awb-core/src/common.jsView on unpkg · L6Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L1