Loading npm security reports…
NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli
Installing the package runs a downloader automatically. It retrieves and executes an unverified native binary whose install behavior is not present in this package.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn automatic postinstall hook invokes the downloader.
package.jsonView on unpkg · L30The hook fetches an unpinned latest native release asset from GitHub, following redirects.
bin.jsView on unpkg · L100It writes that opaque binary to the user’s local bin directory and executes its install command.
bin.jsView on unpkg · L127The executed binary is outside this package snapshot, so its installation behavior cannot be verified here.
bin.jsView on unpkg · L151This report applies to nur-cli@0.35.4.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L31An automatic postinstall hook invokes the downloader.
package.jsonView on unpkg · L30The hook fetches an unpinned latest native release asset from GitHub, following redirects.
bin.jsView on unpkg · L100It writes that opaque binary to the user’s local bin directory and executes its install command.
bin.jsView on unpkg · L127The executed binary is outside this package snapshot, so its installation behavior cannot be verified here.
bin.jsView on unpkg · L151