npm analyzed 4.8.3

agent-afk

v4.8.3

npm

Open-source coding-agent harness you can actually change — own the loop (prompts, gates, routing, skills, terminal states), use any model, run long tasks while you're away.

maintainer: griffinwork40
license: Apache-2.0
first seen: 2026-06-08
last seen: 2026-06-17
releases · 30d: 341
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v4.8.3 · analyzer v18 · 9h ago

skills & prompt files 14

code evidence v4.8.3 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 2

fs package/dist/postinstall.mjs :14 import { readFileSync } from 'node:fs';
fs package/scripts/postinstall.mjs :14 import { readFileSync } from 'node:fs';

shell / exec 4

shell package/dist/index.mjs :2 `)}}}catch{}}function Fi(){Op(Mp(),it())}function Nt(t){return typeof t=="string"&&t.length>0&&t.length<=Fp&&Dp.test(t)}function Dn(t){if(!Nt(t))throw new Error(`Invalid session id for ledger path: ${
shell package/dist/postinstall.mjs :13 import { execSync } from 'node:child_process';
shell package/dist/telegram.mjs :139 ${e}`:`\u{1F3F7}\uFE0F Named: ${t} (saves on first turn)`}function Jn(t){if(!t)return"\u{1F4E6} Conversation compacted (older messages summarized).";let e=t.tokensSavedEstimate!==void 0&&t.tokensSaved
shell package/scripts/postinstall.mjs :13 import { execSync } from 'node:child_process';

network 2

net package/dist/index.mjs :3 `)}return n.accessToken}function pi(){if(process.platform==="darwin")try{return ci("security",["find-generic-password","-s","Claude Code-credentials","-a",di().username,"-w"],{stdio:["ignore","pipe","
net package/dist/telegram.mjs :140 `)}return n.accessToken}function Fa(){if(process.platform==="darwin")try{return Ca("security",["find-generic-password","-s","Claude Code-credentials","-a",Oa().username,"-w"],{stdio:["ignore","pipe","

secrets 2

secrets package/dist/index.mjs :1 var ep=Object.defineProperty;var fe=(t,e)=>()=>(t&&(e=t(t=0)),e);var Vs=(t,e)=>{for(var n in e)ep(t,n,{get:e[n],enumerable:!0})};function vn(t){return Sn.find(e=>e.name===t)}function Yr(t){return proc
secrets package/dist/telegram.mjs :2 var Wf=Object.defineProperty;var ye=(t,e)=>()=>(t&&(e=t(t=0)),e);var Oi=(t,e)=>{for(var n in e)Wf(t,n,{get:e[n],enumerable:!0})};function Tn(t){return xn.find(e=>e.name===t)}function vo(t){return proc

install hooks 1

postinstall package/package.json :80 node dist/postinstall.mjs || node scripts/postinstall.mjs || true

declared dependencies 36

@anthropic-ai/sdk@^0.74.0
@modelcontextprotocol/sdk@^1.29.0
@mozilla/readability@^0.6.0
ansi-escapes@^7.3.0
better-sqlite3@^12.9.0
chalk@^5.3.0
commander@^12.1.0
dotenv@^16.4.7
emphasize@^7.0.0
jsdom@^29.1.1
log-update@^8.0.0
marked@^17.0.5
node-cron@^4.2.1
openai@^6.38.0
ora@^8.1.1
playwright@^1.49.0
string-width@^8.2.0
telegraf@^4.16.3
turndown@^7.2.4
wrap-ansi@^10.0.0
zod@^4.3.6
@types/better-sqlite3@^7.6.13
@types/jest@^30.0.0
@types/jsdom@^28.0.3
@types/node@^22.19.10
@types/node-cron@^3.0.11
@types/turndown@^5.0.6
@vitest/coverage-v8@^2.1.8
@xterm/headless@^6.0.0
esbuild@^0.28.0
jest@^30.2.0
memfs@^4.56.10
ts-jest@^29.4.6
tsx@^4.19.2
typescript@^5.7.3
vitest@^2.1.8