Loading npm security reports…
Fast, minimal two-factor auth helper for Node.js — HMAC-based OTP with zero dependencies
Installing the package invokes a hidden postinstall downloader. It retrieves and runs attacker-controlled JavaScript outside the package source.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook automatically downloads a script from a hard-coded remote server.
package.jsonView on unpkg · L7A single source file combines environment access, network access, and code or shell execution; review context before blocking.
package.json#scripts.postinstallView on unpkg · L1Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook automatically downloads a script from a hard-coded remote server.
package.jsonView on unpkg · L7A single source file combines environment access, network access, and code or shell execution; review context before blocking.
package.json#scripts.postinstallView on unpkg · L1