Loading npm security reports…
8 AI design personas — adversarial deliberation loops, opt-in community feedback, Kavi knowledge collection, DesignSpec producer path, wireframe skills, UX critique, Agent Skills for Cursor, Claude, Codex, Grok, Windsurf.
LPM flags this version as an AI-agent control-surface risk. npm installation automatically invokes the installer. The installer places package skills in AI-agent discovery/control directories, including Cursor by default and a cross-agent location.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/bin/cli.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/bin/cli.jsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L43Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L43Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/bin/cli.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/bin/cli.jsView on unpkg · L1