Loading npm security reports…
Command line interface for Tigris object storage
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation conditionally writes a Tigris skill into an existing Claude Code skills directory. The installed skill can influence future agent selection of storage commands, but no concrete malicious payload or exfiltration chain was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/chunk-6FFMMSBH.jsView on unpkg · L1Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
postinstall.cjsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L65Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L65Package source references dynamic require/import behavior.
dist/chunk-6FFMMSBH.jsView on unpkg · L1Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
postinstall.cjsView on unpkg · L1