Loading npm security reports…
NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli
Installing the package automatically retrieves and executes an unverified native release binary. The executed binary is instructed to perform further installation and system setup.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgAn automatic postinstall hook runs the downloader.
package.jsonView on unpkg · L30Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe hook downloads a latest-release native binary without a hash or signature check.
bin.jsView on unpkg · L100It writes the downloaded binary to the user-local bin directory and marks it executable.
bin.jsView on unpkg · L127It immediately executes the opaque binary with an install command that can provision additional components.
bin.jsView on unpkg · L134This report applies to nur-cli@0.36.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L31An automatic postinstall hook runs the downloader.
package.jsonView on unpkg · L30The hook downloads a latest-release native binary without a hash or signature check.
bin.jsView on unpkg · L100It writes the downloaded binary to the user-local bin directory and marks it executable.
bin.jsView on unpkg · L127It immediately executes the opaque binary with an install command that can provision additional components.
bin.jsView on unpkg · L134