@capsense/core-ui@99.99.99
Authorized security research placeholder for responsible disclosure to Microsoft MSRC (dependency-confusion PoC). Non-malicious: beacons package name and host only, no secrets. Please contact the reporter and reserve this scope.
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource confirms automatic lifecycle-triggered disclosure of identifying installation data to publisher-selected external collectors without installer consent. This supports blocking as install-hook abuse.
Decision evidence
public snapshot- The package runs beacon.js automatically during preinstall, install, and postinstall.
- The beacon collects the package and lifecycle stage, hostname, username, and platform.
- It sends the collected label through DNS and HTTPS to fixed external collectors without a consent check.
Source & flagged code
9 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs beacon.js automatically during preinstall, install, and postinstall.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @capsense/core-ui@99.99.99.
See all versions of @capsense/core-ui for other recorded verdicts.
- Avoid installing @capsense/core-ui@99.99.99. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.