Loading npm security reports…
Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.
LPM treats this as warn-only first-party agent extension lifecycle risk. On npm postinstall, the package retrieves and executes remote installer/binary code, then registers hooks for Claude Code. The package JS does not expose the downloaded binary's hook mutations for review.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L15A single source file combines environment access, network access, and code or shell execution; review context before blocking.
install.jsView on unpkg · L6Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L28Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
install.jsView on unpkg · L6Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L15