Loading npm security reports…
Stable terminal UI for Codex and Claude Agent SDK
LPM flags this version as an AI-agent control-surface risk. npm installation automatically modifies global Codex and Claude skill control surfaces. It installs a package-supplied agent skill and prunes files in those destinations.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs install-skills.mjs automatically through npm postinstall.
package.jsonView on unpkg · L40Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1The installer targets both Codex and Claude user skill directories outside the package.
install-skills.mjsView on unpkg · L14The installer recursively copies its skill and deletes destination entries absent from the package.
install-skills.mjsView on unpkg · L38This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L41The package runs install-skills.mjs automatically through npm postinstall.
package.jsonView on unpkg · L40This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgThe installer targets both Codex and Claude user skill directories outside the package.
install-skills.mjsView on unpkg · L14Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1The installer recursively copies its skill and deletes destination entries absent from the package.
install-skills.mjsView on unpkg · L38