Loading npm security reports…
BYOK fork of the Codebuff CLI. Bring your own provider key (OpenAI, Anthropic, OpenRouter, OpenCode Zen/Go, custom OpenAI-compat). No codebuff.com account required.
The install hook deletes a similarly named existing CLI binary. On a later CLI invocation, the launcher fetches, extracts, and executes an unsigned remote binary.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2Installation automatically deletes both the fork binary and a separately named codebuff binary from the user's configuration directory.
postinstall.jsView on unpkg · L11This report applies to codebuff-mod@1.4.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L2Installation automatically deletes both the fork binary and a separately named codebuff binary from the user's configuration directory.
postinstall.jsView on unpkg · L11