Loading npm security reports…
四川大学校园服务命令行工具（教务/微服务/缴费/体测/第二课堂），面向 AI 代理与脚本设计
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall fetches an unbundled native executable and installs a package-named Claude Skill. The source shows no exfiltration or broad agent-control mutation.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/scu.jsView on unpkg · L4Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L4This report applies to @the-brotherhood-of-scu/scu-cli@0.3.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L4Package source references dynamic require/import behavior.
bin/scu.jsView on unpkg · L4