Loading npm security reports…
火山方舟 ARK 平台命令行工具
LPM treats this as warn-only first-party agent extension lifecycle risk. On npm installation, the package downloads a platform binary, stores it under its package directory, and executes it to refresh and install skills for detected agents. The binary and resulting agent mutations are not included for source review.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall lifecycle downloads and executes a platform binary.
package.jsonView on unpkg · L13Package source references child process execution.
scripts/postinstall.jsView on unpkg · L23A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/postinstall.jsView on unpkg · L20Install lifecycle downloads and executes a platform binary.
scripts/postinstall.jsView on unpkg · L127Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L14Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L14Install lifecycle downloads and executes a platform binary.
package.jsonView on unpkg · L13Package source references child process execution.
scripts/postinstall.jsView on unpkg · L23A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/postinstall.jsView on unpkg · L20Install lifecycle downloads and executes a platform binary.
scripts/postinstall.jsView on unpkg · L127