Loading npm security reports…
Bridge de comunicação tipado e **agnóstico de transporte** entre uma aplicação host e os apps que ela embute — um `<iframe>` no web, uma `<WebView>` no mobile.
LPM treats this as warn-only first-party agent extension lifecycle risk. On npm postinstall, the package mutates the consuming project's Claude Code extension surface. It installs its own prefixed skill and adds a scoped import to .claude/CLAUDE.md; no exfiltration or remote execution was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup.mjsView on unpkg · L3Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L55Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup.mjsView on unpkg · L3