Loading npm security reports…
Claude Code skill for HyperFrames animation pipeline — natural language to rendered video
LPM treats this as warn-only first-party agent extension lifecycle risk. The package performs first-party Claude skill setup during npm postinstall and runs a catalog sync helper. This is install-time AI-agent extension lifecycle risk, but source inspection did not confirm malicious hijack, exfiltration, or destructive behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time source drops package-supplied AI-agent/MCP control files or instructions.
install.jsView on unpkg · L12Package ships non-JavaScript build or shell helper files.
skills/hyper-animator/scripts/preview-gen.pyView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L35Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L35Package ships non-JavaScript build or shell helper files.
skills/hyper-animator/scripts/preview-gen.pyView on unpkgInstall-time source drops package-supplied AI-agent/MCP control files or instructions.
install.jsView on unpkg · L12