Loading npm security reports…
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit gm-plugkit CLI use downloads and executes a native runner, then provisions persistent agent skills and project instruction wiring. The installed skill directs agents to a local daemon instruction channel.
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bootstrap.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bootstrap.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgPackage source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgSource downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bootstrap.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bootstrap.jsView on unpkg