Loading npm security reports…
CLI tool for 智贸云图 (ZMYT) foreign trade SaaS platform REST APIs
LPM flags this version as an AI-agent control-surface risk. Installation can place a package-controlled AI skill in the user's global agent skills directory. It can remove an existing matching skill without consent.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest automatically runs a postinstall script.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L3The postinstall global-install test also accepts any postinstall whose initial working directory differs from the package directory, so it can run during ordinary dependency installation.
scripts/postinstall.mjsView on unpkg · L41It creates ~/.agents/skills, deletes an existing matching skill recursively, and replaces it with a package-controlled symlink.
scripts/postinstall.mjsView on unpkg · L55This report applies to zmyt-cli@0.2.9.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11The manifest automatically runs a postinstall script.
package.jsonView on unpkg · L9The postinstall global-install test also accepts any postinstall whose initial working directory differs from the package directory, so it can run during ordinary dependency installation.
scripts/postinstall.mjsView on unpkg · L41It creates ~/.agents/skills, deletes an existing matching skill recursively, and replaces it with a package-controlled symlink.
scripts/postinstall.mjsView on unpkg · L55Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L3