Loading npm security reports…
Deploy any directory to your own cloud and get a URL. Guided deploys that catch what breaks before it breaks, plus Postgres, domains and scaling — driven from your terminal, or by Claude Code and OpenAI Codex through the bundled agent skill.
LPM treats this as warn-only first-party agent extension lifecycle risk. Global installation automatically adds the package's uncloud skill to pre-existing third-party coding-agent skill directories. This is a package-owned extension setup, not a confirmed payload or exfiltration chain.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/uncloud.jsView on unpkg · L10Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
lib/skill.jsView on unpkg · L9Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L59Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L59Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/uncloud.jsView on unpkg · L10Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
lib/skill.jsView on unpkg · L9