Loading npm security reports…
**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.
On npm postinstall, the package fetches the latest release archive from its Gitea host and installs its binary. This creates an unpinned remote-payload supply-chain surface; no confirmed malicious payload behavior is present in readable source.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgpostinstall queries the latest remote release, decoupled from package version.
postinstall.mjsView on unpkg · L75Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L8Package ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgpostinstall queries the latest remote release, decoupled from package version.
postinstall.mjsView on unpkg · L75