Loading npm security reports…
Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration
Static analysis flagged 26 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references child process execution.
dist/shared/process.jsView on unpkg · L1Package source references shell execution.
dist/cli/commands/test-commands.jsView on unpkg · L110Package source references dynamic require/import behavior.
dist/cli/commands/governance-classify-contract-commands.jsView on unpkg · L151Package source references weak cryptographic algorithms.
dist/services/code/job-shape-decision.jsView on unpkg · L92Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skills.mjsView on unpkg · L1Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/commands/hooks-commands.jsView on unpkgManifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/commands/hooks-commands.jsView on unpkgPackage source invokes a package manager install command at runtime.
dist/cli/commands/playwright-commands.jsView on unpkg · L27A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/peaks.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/cron-scheduler-commands.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/dispatch/dispatch-record-writer.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/web/daemon-supervisor.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/best-practice-scan-command.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/lease-metrics-commands.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/scan/orphan-service.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/peaks.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/prd/best-practice-auto-trigger.jsView on unpkgThis report applies to peaks-loop@4.0.48.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L133Package source references child process execution.
dist/shared/process.jsView on unpkg · L1Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skills.mjsView on unpkg · L1Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/commands/hooks-commands.jsView on unpkgManifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/commands/hooks-commands.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/peaks.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/cron-scheduler-commands.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/dispatch/dispatch-record-writer.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/web/daemon-supervisor.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/best-practice-scan-command.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/commands/lease-metrics-commands.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/scan/orphan-service.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/peaks.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/prd/best-practice-auto-trigger.jsView on unpkgPackage source references shell execution.
dist/cli/commands/test-commands.jsView on unpkg · L110Package source references dynamic require/import behavior.
dist/cli/commands/governance-classify-contract-commands.jsView on unpkg · L151Package source references weak cryptographic algorithms.
dist/services/code/job-shape-decision.jsView on unpkg · L92Package source invokes a package manager install command at runtime.
dist/cli/commands/playwright-commands.jsView on unpkg · L27