Loading npm security reports…
Single-agent terminal AI engineering runtime with full tools, direct execution, and clean UX.
Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/hablas-shim.jsView on unpkg · L2A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L10A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L10This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgSource combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L10Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L1Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L10Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L24Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L24Package source references dynamic require/import behavior.
bin/hablas-shim.jsA single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L10Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L10Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L10This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgSource exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L10