Loading npm security reports…
Personal, passkey-protected memory for Claude, Codex, and other MCP clients
Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Package source references child process execution.
dist/npm-cli/scripts/passkeys.jsView on unpkg · L1Package source invokes a package manager install command at runtime.
dist/npm-cli/scripts/dev.jsView on unpkg · L30This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/npm-cli/scripts/setup.jsView on unpkgPackage source references child process execution.
dist/npm-cli/scripts/passkeys.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/npm-cli/scripts/setup.jsView on unpkgPackage source invokes a package manager install command at runtime.
dist/npm-cli/scripts/dev.jsView on unpkg · L30