Loading npm security reports…
Stable terminal UI for Codex and Claude Agent SDK
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically replaces skill trees in both Codex and Claude configuration areas. It also installs Python dependencies into the user's environment.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/insane-search/tests/live_benchmark/bench.pyView on unpkgPackage ships non-JavaScript build or shell helper files.
skills/insane-search/tests/live_benchmark/bench.pyView on unpkgThis report applies to devez-vibe@1.7.89.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L45Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L45Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/insane-search/tests/live_benchmark/bench.pyView on unpkgPackage ships non-JavaScript build or shell helper files.
skills/insane-search/tests/live_benchmark/bench.pyView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install-skills.mjsView on unpkg · L1