Loading npm security reports…
Stable terminal UI for Codex and Claude Agent SDK
Installing the package automatically modifies two user-level AI-agent skill directories. It copies a bundled skill and prunes existing destination content.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs its installer automatically through an npm postinstall hook.
package.jsonView on unpkg · L40Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1The installer targets both the user's Codex and Claude skill directories.
install-skills.mjsView on unpkg · L14Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgThis report applies to devez-vibe@1.7.8.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L41The package runs its installer automatically through an npm postinstall hook.
package.jsonView on unpkg · L40Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bridge/claude-agent-sdk-bridge.mjsView on unpkgThe installer targets both the user's Codex and Claude skill directories.
install-skills.mjsView on unpkg · L14Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1