Loading npm security reports…
Super Audit（SA）工程方法包安装器：自动探测已装宿主，将完整 assistant Skill 目录安装到宿主官方 Skill 目录
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically launches a bundled executable that installs assistant skills. This mutates AI-agent skill control surfaces without an explicit user command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package registers an automatic postinstall hook.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/super-audit.jsView on unpkgThe shim forwards its arguments to a bundled platform executable.
bin/super-audit.jsView on unpkg · L41The postinstall hook runs the command shim with the install argument.
bin/postinstall.jsView on unpkg · L5The bundled executable contains an assistant skill-root installer payload.
dist/super-audit-darwin-arm64View on unpkg · L7766This report applies to super-audit@5.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L10The package registers an automatic postinstall hook.
package.jsonView on unpkg · L6The bundled executable contains an assistant skill-root installer payload.
dist/super-audit-darwin-arm64View on unpkg · L7766The shim forwards its arguments to a bundled platform executable.
bin/super-audit.jsView on unpkg · L41Source fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/super-audit.jsView on unpkgThe postinstall hook runs the command shim with the install argument.
bin/postinstall.jsView on unpkg · L5