Loading npm security reports…
Super Audit（SA）工程方法包安装器：自动探测已装宿主，将完整 assistant Skill 目录安装到宿主官方 Skill 目录
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically runs an installer that invokes an opaque native payload. The payload carries managed assistant-skill content, creating an unconsented AI-agent control-surface mutation risk.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs a postinstall hook automatically.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe native payload contains managed assistant-skill markers.
dist/super-audit-linux-arm64View on unpkg · L8858That hook invokes the install command without a user command.
bin/postinstall.jsView on unpkg · L7The install path dispatches a bundled native executable.
bin/super-audit.jsView on unpkg · L40This report applies to super-audit@0.3.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L10The package runs a postinstall hook automatically.
package.jsonView on unpkg · L9The native payload contains managed assistant-skill markers.
dist/super-audit-linux-arm64View on unpkg · L8858That hook invokes the install command without a user command.
bin/postinstall.jsView on unpkg · L7The install path dispatches a bundled native executable.
bin/super-audit.jsView on unpkg · L40