Loading npm security reports…
LeanCTX — the Context OS for AI coding agents. One local binary that compresses, remembers, routes, and verifies every token between your code and the model. No Rust required.
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall obtains a remote native payload and executes its onboard action. That action may connect or configure third-party AI tools, but its native implementation is absent from the package.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-named source file stages remote content through filesystem writes and execution.
postinstall.jsView on unpkg · L3Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L30Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L30Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L6Install-named source file stages remote content through filesystem writes and execution.
postinstall.jsView on unpkg · L3