Loading npm security reports…
DCS - Development Command System. An installable Claude Code skill package that adapts the ICS Planning P to the software development cycle: typed incidents, a hook-enforced plan-approval gate, Opus section chiefs, Sonnet specialists, an adversarial Safet
LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall mutates an existing Claude Code extension directory by installing DCS-owned content. Project hooks are copied and only wired into settings after explicit user consent; no exfiltration path was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/dcs.jsView on unpkg · L1Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/test_dcs_cli.pyView on unpkgThis report applies to dcs-command-system@0.9.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L29Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/test_dcs_cli.pyView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/dcs.jsView on unpkg · L1