Loading npm security reports…
OneScience AI coding agent for the terminal.
npm postinstall fetches an unauthenticated remote platform archive, extracts it into node_modules, and stages its executable. It also links hidden agent-related asset directories from that archive into the package root.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgThe bootstrap downloads a versioned native archive from a raw-IP HTTPS endpoint or environment override.
platform-bootstrap.mjsView on unpkg · L15TLS certificate validation is explicitly disabled for that download.
platform-bootstrap.mjsView on unpkg · L98postinstall invokes the platform bootstrap during npm installation.
postinstall.mjsView on unpkg · L15Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10The bootstrap downloads a versioned native archive from a raw-IP HTTPS endpoint or environment override.
platform-bootstrap.mjsView on unpkg · L15TLS certificate validation is explicitly disabled for that download.
platform-bootstrap.mjsView on unpkg · L98Source file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgpostinstall invokes the platform bootstrap during npm installation.
postinstall.mjsView on unpkg · L15