Loading npm security reports…
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit gm-plugkit CLI use downloads a verified native runner, starts a spool daemon, and installs agent/project instruction wiring. This creates a package-owned agent control surface but no unconsented install-time activation is present.
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgPackage source references child process execution.
bootstrap-shared.jsView on unpkg · L5Source file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgSource downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L7A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bootstrap.jsView on unpkg · L7