Loading npm security reports…
Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dbt-tools/dist/index.jsView on unpkg · L68A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dbt-tools/dist/index.jsView on unpkg · L24057Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dbt-tools/dist/index.jsView on unpkg · L2028Package source references a known benign dynamic code generation pattern.
dbt-tools/dist/index.jsView on unpkg · L917Package source references weak cryptographic algorithms.
dbt-tools/dist/index.jsView on unpkg · L68Package ships non-JavaScript build or shell helper files.
dbt-tools/dist/node_python_bridge.pyView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L8Package source references child process execution.
dbt-tools/dist/index.jsView on unpkg · L68A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dbt-tools/dist/index.jsView on unpkg · L24057Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dbt-tools/dist/index.jsView on unpkg · L2028Package ships non-JavaScript build or shell helper files.
dbt-tools/dist/node_python_bridge.pyView on unpkgPackage source references a known benign dynamic code generation pattern.
dbt-tools/dist/index.jsView on unpkg · L917Package source references weak cryptographic algorithms.
dbt-tools/dist/index.jsView on unpkg · L68