Loading npm security reports…
Command line interface for Tigris object storage
LPM treats this as warn-only first-party agent extension lifecycle risk. On dependency installation, the package conditionally adds a bundled Tigris skill to an existing Claude Code global skills directory. No install-time network or command execution beyond Node file operations was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgA postinstall lifecycle hook runs automatically on dependency installation.
package.jsonView on unpkg · L68Package source references dynamic require/import behavior.
dist/chunk-WIJB3E2C.jsView on unpkg · L1Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
postinstall.cjsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L68Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L68A postinstall lifecycle hook runs automatically on dependency installation.
package.jsonView on unpkg · L68Package source references dynamic require/import behavior.
dist/chunk-WIJB3E2C.jsView on unpkg · L1Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
postinstall.cjsView on unpkg · L1