Loading npm security reports…
RD-X-96 is a standalone terminal coding assistant. Connect your own API-key or subscription provider and work with your chosen model.
A user-invoked launcher fetches an executable archive chosen by a registry response and executes it without signature or checksum verification. Its install hook also removes named binaries in the user configuration directory.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2The launcher selects the latest registry version, downloads a GitHub release archive, and executes its extracted binary without an integrity check.
index.jsView on unpkg · L303This report applies to codebuff-mod@1.6.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L12Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L12Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2The launcher selects the latest registry version, downloads a GitHub release archive, and executes its extracted binary without an integrity check.
index.jsView on unpkg · L303