Loading npm security reports…
DCS - Development Command System. An installable Claude Code skill package that adapts the ICS Planning P to the software development cycle: typed incidents, a hook-enforced plan-approval gate, Opus section chiefs, Sonnet specialists, an adversarial Safet
LPM flags this version as an AI-agent control-surface risk. Installing the package can automatically modify existing Claude and DSH agent homes. It installs agent payloads and registers a lifecycle bridge without an explicit setup command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/dcs.jsView on unpkg · L6A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
bin/dcs.jsView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/test_bridge_mapping.pyView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/dcs.js#virtual:normalized:round1View on unpkgThis report applies to dcs-command-system@0.12.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L29Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/test_bridge_mapping.pyView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/dcs.js#virtual:normalized:round1View on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/dcs.jsView on unpkg · L6A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
bin/dcs.jsView on unpkg