Loading npm security reports…
四川大学校园服务命令行工具（教务/微服务/缴费/体测/第二课堂），面向 AI 代理与脚本设计
LPM flags this version as an AI-agent control-surface risk. Every npm installation downloads a native executable and writes a Claude skill under the installing user's ~/.claude directory. This unconsented postinstall mutation affects a broad AI-agent control surface.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/scu.jsView on unpkg · L4Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L4This report applies to @the-brotherhood-of-scu/scu-cli@0.5.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L4Package source references dynamic require/import behavior.
bin/scu.jsView on unpkg · L4