Loading npm security reports…
NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli
LPM treats this as warn-only first-party agent extension lifecycle risk. An automatic postinstall hook downloads an unsigned native binary from GitHub Releases into the user home bin directory and immediately runs that binary's install command. Further PATH and agent-stack changes are owned by that opaque native installer, not by inspectable JavaScript.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall runs node bin.js --ensure and swallows failure with exit 0, so a normal install automatically fetches and runs a native binary.
package.jsonView on unpkg · L30Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin.jsView on unpkgbin.js downloads a GitHub Releases asset (latest first, then a pinned fallback) with no checksum or signature check.
bin.jsView on unpkg · L100The downloaded bytes are written to ~/.local/bin/nur or nur.exe and marked executable.
bin.jsView on unpkg · L83This report applies to nur-cli@0.31.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L31postinstall runs node bin.js --ensure and swallows failure with exit 0, so a normal install automatically fetches and runs a native binary.
package.jsonView on unpkg · L30The downloaded bytes are written to ~/.local/bin/nur or nur.exe and marked executable.
bin.jsView on unpkg · L83bin.js downloads a GitHub Releases asset (latest first, then a pinned fallback) with no checksum or signature check.
bin.jsView on unpkg · L100Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin.jsView on unpkg