rakumux@0.1.44
Terminal session manager for coding agents, with a fast TUI, a background session daemon and an MCP server
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe install hook stages this terminal session manager’s bundled scripts and binaries, with no install-time network access or credential collection found. The native binaries are not fully inspectable from the supplied analysis summaries, but their stated role matches the package’s purpose.
Decision evidence
public snapshot- The postinstall hook runs install.js to set up the package.
- Setup copies the bundled launcher scripts and binaries into dist/.
- The update check is available through an explicit --check-updates or --update command.
- The package describes itself as a terminal session manager with a TUI, background daemon, and MCP server.
- The inspected install code stages local package assets; no install-time network or credential collection was identified.
- The native binaries support the package’s stated purpose; their behavior could not be resolved from the supplied analysis summaries.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs install.js to set up the package.
package.jsonView on unpkg · L44Findings
Affected versions and remediation
This report applies to rakumux@0.1.44.
See all versions of rakumux for other recorded verdicts.
- Review the evidence and your use of rakumux@0.1.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.