Loading npm security reports…
Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).
npm postinstall can fetch, extract, chmod, and execute an opaque native binary. npm preuninstall invokes that binary's cleanup, which is documented to remove agent integrations.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L13Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
install.jsView on unpkg · L25Install-named source file stages remote content through filesystem writes and execution.
install.jsView on unpkg · L25This report applies to @tokenade/cli@1.1.4.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L13Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
install.jsView on unpkg · L25Install-named source file stages remote content through filesystem writes and execution.
install.jsView on unpkg · L25