Loading npm security reports…
The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.
Static analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage contains a critical-looking secret pattern.
gateway/ai/backends/tools_infra.pyView on unpkg · L79AWS access key ID in gateway/ai/backends/tools_infra.py
gateway/ai/backends/tools_infra.pyView on unpkg · L79AWS access key ID in gateway/ai/backends/tools_infra.py
gateway/ai/backends/tools_infra.pyView on unpkg · L178Package source references child process execution.
bin/delimit-setup.jsView on unpkg · L12Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/delimit-setup.jsView on unpkg · L12Package source invokes a package manager install command at runtime.
bin/delimit-setup.jsView on unpkg · L76Package source references dynamic require/import behavior.
bin/delimit-setup.jsView on unpkg · L10Source writes installer persistence such as shell profile or service configuration.
bin/delimit-setup.jsView on unpkg · L12A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/proxy-handler.jsView on unpkg · L7Package ships native binary artifacts.
gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkgPackage ships non-JavaScript build or shell helper files.
bin/delimit-os.shView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L176Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L176Package ships native binary artifacts.
gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkgPackage ships non-JavaScript build or shell helper files.
bin/delimit-os.shView on unpkgPackage contains a critical-looking secret pattern.
gateway/ai/backends/tools_infra.pyView on unpkg · L79AWS access key ID in gateway/ai/backends/tools_infra.py
gateway/ai/backends/tools_infra.pyView on unpkg · L79AWS access key ID in gateway/ai/backends/tools_infra.py
gateway/ai/backends/tools_infra.pyView on unpkg · L178Package source references dynamic require/import behavior.
bin/delimit-setup.jsView on unpkg · L10Package source references child process execution.
bin/delimit-setup.jsView on unpkg · L12Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/delimit-setup.jsView on unpkg · L12Source writes installer persistence such as shell profile or service configuration.
bin/delimit-setup.jsView on unpkg · L12Package source invokes a package manager install command at runtime.
bin/delimit-setup.jsView on unpkg · L76A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/proxy-handler.jsView on unpkg · L7