Loading npm security reports…
Dynamic Object Manipulation & Modeling API - A complete front-end toolkit.
LPM flags this version as an AI-agent control-surface risk. Install-time code attempts to add Claude Code instruction and settings files outside the package. The prompt treats an empty answer as acceptance and writes only when targets do not already exist.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/postinstall.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/domma-cli.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/domma-cli.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L38Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L38Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/domma-cli.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/domma-cli.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/postinstall.jsView on unpkg · L7