rakumux@0.1.40
Terminal session manager for coding agents, with a fast TUI, a background session daemon and an MCP server
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook stages the package’s own scripts and bundled binaries, while the entry points dispatch the requested Rakumux command. The only observed network behavior is a limited update-version query; no malicious data flow or unauthorized action was identified.
Decision evidence
public snapshot- The postinstall hook runs install.js, which stages the package’s scripts and platform-matched bundled binaries into dist/.
- The hook performs setup only when npm_lifecycle_event is postinstall; CLI invocations dispatch a named command.
- Launching the TUI checks for updates at most daily; the check queries the rakumux package version through npm.
- The package describes Rakumux as a terminal session manager and documents its TUI and CLI commands.
- The shipped native binaries have unresolved offline analysis, but the inspected launchers invoke them as the package’s terminal, MCP, and API tools.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs install.js, which stages the package’s scripts and platform-matched bundled binaries into dist/.
package.jsonView on unpkg · L44Findings
Affected versions and remediation
This report applies to rakumux@0.1.40.
See all versions of rakumux for other recorded verdicts.
- Review the evidence and your use of rakumux@0.1.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.