Loading npm security reports…
OneScience AI coding agent for the terminal.
npm postinstall retrieves an unverified remote archive over TLS with certificate validation disabled. It extracts and stages an executable plus agent-related assets inside the installed package for later CLI execution.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
platform-bootstrap.mjsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Source file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
platform-bootstrap.mjsView on unpkg