Loading npm security reports…
BYOK fork of the Codebuff CLI. Bring your own provider key (OpenAI, Anthropic, OpenRouter, OpenCode Zen/Go, custom OpenAI-compat). No codebuff.com account required.
The package deletes existing CLI binaries during installation. When its command is run, it fetches a mutable latest release archive, extracts it, and executes the resulting binary without an integrity check.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2The automatic postinstall hook deletes both the upstream and fork binary names from the user's configuration directory.
postinstall.jsView on unpkg · L11This report applies to codebuff-mod@1.4.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2The automatic postinstall hook deletes both the upstream and fork binary names from the user's configuration directory.
postinstall.jsView on unpkg · L11