Loading npm security reports…
Automation Agent
No confirmed malicious behavior was identified in the readable launcher scripts. However, installation automatically starts an opaque bundled Java payload.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
jdeploy-bundle/jdeploy.jsView on unpkg · L5Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.jsView on unpkg · L8Package ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkgPackage ships compressed or archive-like blobs.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.4.7.jarView on unpkgThis report applies to automation-tool-manager@1.9.18.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L37Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L38Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L38Package ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkgPackage ships compressed or archive-like blobs.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.4.7.jarView on unpkgPackage source references child process execution.
jdeploy-bundle/jdeploy.jsView on unpkg · L5Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.jsView on unpkg · L8