Loading npm security reports…
Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.
LPM flags this version as an AI-agent control-surface risk. npm postinstall fetches and executes an unpinned remote shell script, then registers Claude Code hooks via a downloaded binary. This mutates an AI-agent control surface without an explicit setup command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L15A single source file combines environment access, network access, and code or shell execution; review context before blocking.
install.jsView on unpkg · L6Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L28Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
install.jsView on unpkg · L6Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.jsView on unpkg · L15