Loading npm security reports…
Importing the package retrieves remotely controlled Gist content and executes it as JavaScript. The fetched payload can perform arbitrary actions in the importing process.
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgSource fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg