Loading npm security reports…
OneScience AI coding agent for the terminal.
npm postinstall can retrieve and install an unverified native executable outside npm integrity controls. The fetched executable is subsequently launched by the onecode command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/onecodeView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10Source file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/onecodeView on unpkg