Loading npm security reports…
Automation Agent
Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgPackage ships compressed or archive-like blobs.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
jdeploy-bundle/jdeploy.jsView on unpkgThis report applies to automation-tool-manager@1.9.4.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L38Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L38Package ships non-JavaScript build or shell helper files.
scripts/setup.shView on unpkgPackage ships high-entropy non-source blobs.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgPackage ships compressed or archive-like blobs.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
jdeploy-bundle/tool-manager-1.3.9.jarView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
jdeploy-bundle/jdeploy.jsView on unpkg