Loading npm security reports…
**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.
Installation retrieves an unpinned latest executable archive and installs it into the package. It also changes the user's Python environment through pip.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgnpm automatically runs a postinstall hook.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/tfcode.jsView on unpkgThis report applies to @toothfairyai/tfcode@2.5.7.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L8npm automatically runs a postinstall hook.
package.jsonView on unpkg · L7Package ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/tfcode.jsView on unpkg