Loading npm security reports…
Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.
LPM treats this as warn-only first-party agent extension lifecycle risk. After a user connects the CLI, it installs a Pantheon MCP server and agent instructions across several AI coding clients. This is a broad first-party agent-extension setup rather than an npm install-time attack.
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/pantheon.mjsView on unpkg · L1237A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/pantheon.mjsView on unpkgPackage source references child process execution.
dist/pantheon.mjsView on unpkg · L39849Package source references a known benign dynamic code generation pattern.
dist/pantheon.mjsView on unpkg · L2953This report applies to pantheon-cli@0.2.103.
See version security history for other recorded verdicts.
Evidence last updated: .
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/pantheon.mjsView on unpkg · L1237A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/pantheon.mjsView on unpkgPackage source references child process execution.
dist/pantheon.mjsView on unpkg · L39849Package source references a known benign dynamic code generation pattern.
dist/pantheon.mjsView on unpkg · L2953