Loading npm security reports…
Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.
LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package automatically materializes its agent framework in the consumer project. No confirmed credential theft, remote payload execution, or destructive attack was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage contains a possible secret pattern.
.agents/scripts/lib/qa/redact-evidence.jsView on unpkg · L17Package source references dynamic require/import behavior.
bin/mandrel.jsView on unpkg · L101Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/postinstall.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/cli/init.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/cli/update.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/cli/registry.jsView on unpkgThis report applies to mandrel@2.68.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L71Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L71A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/cli/init.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/cli/update.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/cli/registry.jsView on unpkgPackage contains a possible secret pattern.
.agents/scripts/lib/qa/redact-evidence.jsView on unpkg · L17Package source references dynamic require/import behavior.
bin/mandrel.jsView on unpkg · L101Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/postinstall.jsView on unpkg · L1