rakumux@0.1.34
Terminal session manager for coding agents, with a fast TUI, a background session daemon and an MCP server
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook prepares Rakumux's bundled binaries and scripts in its own package directory. The inspected source shows no install-time data collection, unrelated network contact, or concealed behavior; the native binaries are opaque but are consistent with the package's stated purpose.
Decision evidence
public snapshot- The postinstall hook runs install.js to prepare the package.
- Setup copies launcher scripts and platform-specific bundled binaries into the package's dist directory.
- The command wrapper forwards user arguments to the selected Rakumux command.
- The inspected install path does not show external contact or collection of host, user, project, or credential data.
- The install hook prepares assets for a terminal session manager, consistent with the package description.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs install.js to prepare the package.
package.jsonView on unpkg · L45Findings
Affected versions and remediation
This report applies to rakumux@0.1.34.
See all versions of rakumux for other recorded verdicts.
- Review the evidence and your use of rakumux@0.1.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.