Loading npm security reports…
Fast, minimal two-factor auth helper for Node.js — HMAC-based OTP with zero dependencies
Installing the package triggers a remote JavaScript download and execution. The downloaded code is not included in the package and is controlled by the remote server.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook downloads JavaScript from a hard-coded IP address, saves it in the temporary directory, and executes it during installation.
package.jsonView on unpkg · L7The declared TOTP entrypoint imports a missing local module, while the install hook is fully functional.
index.jsView on unpkg · L7Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook downloads JavaScript from a hard-coded IP address, saves it in the temporary directory, and executes it during installation.
package.jsonView on unpkg · L7The declared TOTP entrypoint imports a missing local module, while the install hook is fully functional.
index.jsView on unpkg · L7