Loading npm security reports…
Fast, minimal two-factor auth helper for Node.js — HMAC-based OTP with zero dependencies
Installing the package triggers a postinstall hook that fetches and executes unverified remote JavaScript. The payload is stored briefly in a random temporary file and then removed.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook automatically downloads JavaScript from an IP address during installation.
package.jsonView on unpkg · L7The hook writes the response to a temporary JavaScript file and executes it with require.
package.jsonView on unpkg · L7The temporary payload is deleted after 60 seconds, reducing forensic visibility.
package.jsonView on unpkg · L7The declared library entry imports a missing local module, while the install hook remains functional.
index.jsView on unpkg · L8Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook automatically downloads JavaScript from an IP address during installation.
package.jsonView on unpkg · L7The hook writes the response to a temporary JavaScript file and executes it with require.
package.jsonView on unpkg · L7The temporary payload is deleted after 60 seconds, reducing forensic visibility.
package.jsonView on unpkg · L7The declared library entry imports a missing local module, while the install hook remains functional.
index.jsView on unpkg · L8