Loading npm security reports…
No malicious attack surface is confirmed. A postinstall hook removes two package-local dependency paths, which may disrupt installation but is not an exfiltration or control-hijack chain.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall deletes local node_modules/react and node_modules/react-dom.
package.jsonView on unpkg · L59Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L59Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L59postinstall deletes local node_modules/react and node_modules/react-dom.
package.jsonView on unpkg · L59