Loading npm security reports…
Tier0 CLI — Unified Namespace data platform command line tool
LPM flags this version as an AI-agent control-surface risk. On npm postinstall, the package downloads a native archive, installs its binary, and attempts to globally install a downloaded agent skill. This mutates multiple foreign AI-agent control surfaces without an explicit user command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9