Loading npm security reports…
Deterministic event-sourced context harness for AI-assisted engineering (HydrateZ).
Static analysis completed at 86.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/setup-global.jsView on unpkg · L7Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/setup-global.jsView on unpkgThis report applies to @nemzilla/hydrate@2.3.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L12Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/setup-global.jsView on unpkg · L7Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/setup-global.jsView on unpkg