Loading npm security reports…
NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli
On npm postinstall, the package downloads an opaque latest-release native binary and executes its installer. The checked JavaScript does not itself show a malicious payload.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnpm postinstall invokes the shim automatically.
package.jsonView on unpkg · L30It writes the binary to ~/.local/bin and executes `nur install`.
bin.jsView on unpkg · L127It writes the binary to ~/.local/bin and executes `nur install`.
bin.jsView on unpkg · L134No checksum or signature verification is implemented; only a size minimum is checked.
bin.jsView on unpkg · L123This report applies to nur-cli@0.29.1.
See version security history for other recorded verdicts.
Evidence last updated: .
npm postinstall invokes the shim automatically.
package.jsonView on unpkg · L30Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L31No checksum or signature verification is implemented; only a size minimum is checked.
bin.jsView on unpkg · L123It writes the binary to ~/.local/bin and executes `nur install`.
bin.jsView on unpkg · L127It writes the binary to ~/.local/bin and executes `nur install`.
bin.jsView on unpkg · L134