Loading npm security reports…
Social Neuron subscription 能力 CLI —— 一能力一命令(social-neuron-subscription),薄客户端直达 /subscription/{op}。
LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall installs this package's bundled skill into an OpenClaw skills directory. This is a first-party agent extension setup with a real agent configuration effect, but the inspected code shows no broader control-surface mutation or separate attack behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/cli.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkgPackage source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13This report applies to @social-data/social-neuron-subscription@1.0.8.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/cli.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg