Loading npm security reports…
LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit installation adds package scripts to Claude Code's user hook configuration. When the user runs the watcher, inbound collaboration messages can trigger an autonomous Claude sub-session and optional configured webhooks.
Package source references child process execution.
bin/claude-collab-plugin-agent.jsView on unpkg · L28Package source references dynamic require/import behavior.
bin/claude-collab-plugin-agent.jsView on unpkg · L27Package source invokes a package manager install command at runtime.
src/plugin-doctor.jsView on unpkg · L81This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/claude-collab-plugin-watch.jsView on unpkgPackage source references dynamic require/import behavior.
bin/claude-collab-plugin-agent.jsView on unpkg · L27Package source references child process execution.
bin/claude-collab-plugin-agent.jsView on unpkg · L28This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/claude-collab-plugin-watch.jsView on unpkgPackage source invokes a package manager install command at runtime.
src/plugin-doctor.jsView on unpkg · L81