Loading npm security reports…
Local agent for Orquesta - connects your VM to the Orquesta dashboard
Static analysis flagged 20 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/ui/onboarding.jsView on unpkg · L10A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L671A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L15Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L15Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L994Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L15Package ships non-JavaScript build or shell helper files.
scripts/generate-manifest.shView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L17Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L17Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L18Package ships non-JavaScript build or shell helper files.
scripts/generate-manifest.shView on unpkgPackage source references child process execution.
dist/ui/onboarding.jsView on unpkg · L10A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L15Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L15Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L15A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L671Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L994