Loading npm security reports…
npm install triggers an obfuscated secondary payload. The installer downloads and executes Bun, which runs code capable of evaluating remotely supplied JavaScript and handling GitHub credentials.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
math_init.jsView on unpkg · L1Manifest entrypoint contains risky behavior absent from dist/build output.
setup.mjsView on unpkg · L1Source file is highly similar to a previously finalized malicious package; route for source-aware review.
setup.mjsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
math_init.jsView on unpkg · L1Manifest entrypoint contains risky behavior absent from dist/build output.
setup.mjsView on unpkg · L1Source file is highly similar to a previously finalized malicious package; route for source-aware review.
setup.mjsView on unpkg