Loading npm security reports…
Multi-Agent Workspace Protocol. Just add u. claude → uclaude, codex → ucodex.
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 32 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/ufoo.jsView on unpkgPackage source references dynamic require/import behavior.
bin/ukimi.jsView on unpkg · L13Package source references weak cryptographic algorithms.
src/runtime/projects/projectId.jsView on unpkg · L1A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/coordination/bus/inject.jsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/agents/providers/claudeThreadProvider.jsView on unpkg · L31Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L74Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/postinstall.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/launch/launcher.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/coordination/bus/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/mcpServer.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/ui/rustChatHost.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/launch/ptyWrapper.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/app/chat/transport.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/app/cli/run.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/mcpConfigure.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/run.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/prompts/native/environment.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/providers/credentials/codex.jsView on unpkgThis report applies to u-foo@3.1.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L51Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L51A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgPackage source references weak cryptographic algorithms.
src/runtime/projects/projectId.jsView on unpkg · L1Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/launch/launcher.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/coordination/bus/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/mcpServer.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/ui/rustChatHost.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/launch/ptyWrapper.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/app/chat/transport.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/app/cli/run.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/mcpConfigure.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/runtime/daemon/run.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/prompts/native/environment.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/agents/providers/credentials/codex.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/ufoo.jsView on unpkgPackage source references dynamic require/import behavior.
bin/ukimi.jsView on unpkg · L13A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/coordination/bus/inject.jsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/agents/providers/claudeThreadProvider.jsView on unpkg · L31Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L74Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/postinstall.jsView on unpkg