Loading npm security reports…
CLI tool for 智贸云图 (ZMYT) foreign trade SaaS platform REST APIs
LPM flags this version as an AI-agent control-surface risk. A global npm install silently changes a shared AI-agent skills directory. It can remove an existing matching entry and replace it with a symlink to this package's skill content.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package automatically runs a postinstall script.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L3The script activates for global lifecycle installs and targets the shared AI-agent skills directory.
scripts/postinstall.mjsView on unpkg · L40It recursively deletes an existing matching skill entry, then replaces it with a package-controlled symlink.
This report applies to zmyt-cli@0.2.8.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11The package automatically runs a postinstall script.
package.jsonView on unpkg · L9The script activates for global lifecycle installs and targets the shared AI-agent skills directory.
scripts/postinstall.mjsView on unpkg · L40Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L3It recursively deletes an existing matching skill entry, then replaces it with a package-controlled symlink.
scripts/postinstall.mjsView on unpkg · L82