Loading npm security reports…
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bootstrap.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bootstrap.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgPackage source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgSource downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bootstrap.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bootstrap.jsView on unpkg