Loading npm security reports…
Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.
LPM treats this as warn-only first-party agent extension lifecycle risk. The package intentionally operates an AI-task host with explicit user service installation and Docker-contained coding agents. At task setup it configures MCP access inside the task container and grants Claude noninteractive tool permission there.
Package source references dynamic require/import behavior.
bin/uai-host.mjsView on unpkg · L13Source writes installer persistence such as shell profile or service configuration.
scripts/install/darwin.tsView on unpkg · L4Package ships non-JavaScript build or shell helper files.
scripts/agent/task-status.shView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/engines.tsView on unpkgPackage source references dynamic require/import behavior.
bin/uai-host.mjsView on unpkg · L13Package ships non-JavaScript build or shell helper files.
scripts/agent/task-status.shView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/engines.tsView on unpkgSource writes installer persistence such as shell profile or service configuration.
scripts/install/darwin.tsView on unpkg · L4