Loading npm security reports…
Automation Agent
Install-time setup modifies the user environment and may install browser software. No credential harvesting or exfiltration was confirmed.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall automatically invokes the setup shell script.
package.jsonView on unpkg · L36Package ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkgPackage ships compressed or archive-like blobs.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.3.7.jarView on unpkgThis report applies to automation-tool-manager@1.9.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L38Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L38postinstall automatically invokes the setup shell script.
package.jsonView on unpkg · L36Package ships compressed or archive-like blobs.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/jar-runner.jarView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.3.7.jarView on unpkgPackage ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkg