Loading npm security reports…
Verboo Code — coding agent for the Verboo platform
LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package automatically imports Claude Code skills and plugins into Verboo's global agent configuration. Those copied skills are later available to the Verboo CLI.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L11Source fingerprint signature matches a known malicious package signature; route for source-aware review.
scripts/postinstall.mjsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
dist/cli.mjsView on unpkgPackage contains an oversized executable-looking CLI entrypoint.
dist/cli.mjsView on unpkgThis report applies to @verboo/code@0.15.25.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L32Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L32A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgPackage contains source files above the normal full-analysis size ceiling.
dist/cli.mjsView on unpkgPackage contains an oversized executable-looking CLI entrypoint.
dist/cli.mjsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L11Source fingerprint signature matches a known malicious package signature; route for source-aware review.
scripts/postinstall.mjsView on unpkg