Loading npm security reports…
Agent-board dashboard for Pi: dispatch, monitor, peek/reply, and attach to background Pi sessions.
Installation executes a lifecycle hook that replaces two nested dependencies by downloading fixed versions with npm. This creates an install-time supply-chain and filesystem-mutation surface, but no concrete malicious payload or agent-control hijack was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPostinstall unconditionally runs a patch script.
package.jsonView on unpkg · L52Package source references child process execution.
runner/state-runner.mjsView on unpkg · L8Package source references weak cryptographic algorithms.
src/core/auto-state.mjsView on unpkg · L25Package source invokes a package manager install command at runtime.
scripts/patch-vulns.mjsView on unpkg · L46The hook deletes nested dependency directories and invokes npm install during installation.
scripts/patch-vulns.mjsView on unpkg · L37This report applies to @zhuxixi/pi-agent-board@0.4.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L53Postinstall unconditionally runs a patch script.
package.jsonView on unpkg · L52Package source references child process execution.
runner/state-runner.mjsView on unpkg · L8Package source references weak cryptographic algorithms.
src/core/auto-state.mjsView on unpkg · L25The hook deletes nested dependency directories and invokes npm install during installation.
scripts/patch-vulns.mjsView on unpkg · L37Package source invokes a package manager install command at runtime.
scripts/patch-vulns.mjsView on unpkg · L46