rakumux@0.1.36
Terminal session manager for coding agents, with a fast TUI, a background session daemon and an MCP server
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe install hook only stages the package's scripts and binaries in its own directory, and the inspected scripts reveal no credential collection or unrelated network contact. The only observed network activity is a TUI update-version query; native executable internals could not be resolved.
Decision evidence
public snapshot- The postinstall hook sets up Rakumux by copying its scripts and platform binaries into the package's own dist directory.
- The launcher runs a daily update check only for the TUI; the check queries npm for Rakumux's version.
- The optional shell hook is documented to record commands locally inside a Rakumux session.
- The package ships native executables whose behavior could not be resolved from the available analysis; the package describes them as its terminal, daemon, API, and MCP components.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook sets up Rakumux by copying its scripts and platform binaries into the package's own dist directory.
package.jsonView on unpkg · L29Findings
Affected versions and remediation
This report applies to rakumux@0.1.36.
See all versions of rakumux for other recorded verdicts.
- Review the evidence and your use of rakumux@0.1.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.