Loading npm security reports…
A state management library for Clicktap reference frontend.
No confirmed malicious attack surface. The install hook only blocks nested installs, while runtime network requests use application-supplied endpoints.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe preinstall hook only rejects installs started inside the package tree; it does not write files or invoke network code.
package.jsonView on unpkg · L92This report applies to @clicktap/state@3.0.3.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L93Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L93The preinstall hook only rejects installs started inside the package tree; it does not write files or invoke network code.
package.jsonView on unpkg · L92