Loading npm security reports…
OneScience AI coding agent for the terminal.
Installing the package automatically retrieves a native archive from a fixed remote host with TLS verification disabled. The archive is extracted into node_modules and made executable without a checksum or signature verification.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package automatically runs a postinstall script.
package.jsonView on unpkg · L10Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/onecodeView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/onecodeView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkgThis report applies to @onescience/onecode@1.14.50-202609211543.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L10The package automatically runs a postinstall script.
package.jsonView on unpkg · L10Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/onecodeView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/onecodeView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
platform-bootstrap.mjsView on unpkg