Loading npm security reports…
Verboo Code — coding agent for the Verboo platform
LPM flags this version as an AI-agent control-surface risk. Installation automatically imports foreign Claude Code skills and plugins into Verboo's agent directory. This mutates an AI-agent control surface without an explicit user action.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe npm postinstall hook automatically runs the installer and suppresses failure.
package.jsonView on unpkg · L32Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L11Package contains source files above the normal full-analysis size ceiling.
dist/cli.mjsView on unpkgPackage contains an oversized executable-looking CLI entrypoint.
dist/cli.mjsView on unpkgThis report applies to @verboo/code@0.15.24.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L32The npm postinstall hook automatically runs the installer and suppresses failure.
package.jsonView on unpkg · L32Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L32A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgPackage contains source files above the normal full-analysis size ceiling.
dist/cli.mjsView on unpkgPackage contains an oversized executable-looking CLI entrypoint.
dist/cli.mjsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L11