Loading npm security reports…
Discord/Telegram bot bridge for the Antigravity (agy) CLI, with voice interaction support
LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit setup action registers package scripts as agy lifecycle hooks. The bot then launches agy with permission checks skipped while routing tool approval through a local service.
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
voice-service/stt.jsView on unpkgPackage source references child process execution.
npm-scripts/ensure-env.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkgPackage source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L40Package ships non-JavaScript build or shell helper files.
hooks/hook.pyView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
voice-service/stt.jsView on unpkgPackage source references child process execution.
npm-scripts/ensure-env.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
hooks/hook.pyView on unpkgPackage source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L40This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg