Loading npm security reports…
OneScience AI coding agent for the terminal.
`postinstall` retrieves an unsigned platform archive from a hard-coded IP while TLS certificate validation is disabled. The archive is extracted into `node_modules` and its binary is linked for later CLI execution; package-owned agent asset directories are symlinked locally.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
platform-bootstrap.mjsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Source file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
platform-bootstrap.mjsView on unpkg