Loading npm security reports…
**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.
Installing the package downloads an unpinned latest binary release, installs it into the package, and installs Python packages into the invoking user's environment. Neither remote artifact is verified by an integrity check.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe npm postinstall hook automatically runs the installer.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/tfcode.jsView on unpkgThis report applies to @toothfairyai/tfcode@2.5.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L8The npm postinstall hook automatically runs the installer.
package.jsonView on unpkg · L7Package ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/tfcode.jsView on unpkg