Loading npm security reports…
Stateless, task-oriented AI agent core
No confirmed malicious attack surface. The package intentionally provides a user-invoked AI-agent runtime with optional web fetching, shell execution, LSP spawning, and provider API calls; the reviewed code contains no install-time activation, exfiltration route, reverse socket, or agent-control mutation.
Package source references child process execution.
dist/core/session-store.jsView on unpkg · L95Package source references a known benign dynamic code generation pattern.
dist/core/auto-promote.jsView on unpkg · L32Source matches reverse-shell style process and socket wiring.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1Package source references child process execution.
dist/core/session-store.jsView on unpkg · L95Package source references a known benign dynamic code generation pattern.
dist/core/auto-promote.jsView on unpkg · L32Source matches reverse-shell style process and socket wiring.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1