Loading npm security reports…
Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).
Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
install.jsView on unpkg · L25Install-named source file stages remote content through filesystem writes and execution.
install.jsView on unpkg · L25This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
install.jsView on unpkgThis report applies to @tokenade/cli@0.9.4.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
install.jsView on unpkg · L25Install-named source file stages remote content through filesystem writes and execution.
install.jsView on unpkg · L25This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
install.jsView on unpkg