Loading npm security reports…
A state management library for Clicktap reference frontend.
No attack was identified in the inspected package source. The install hook is a nested-install guard, and the network helper uses caller-provided request arguments.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe preinstall hook only rejects a nested install and prints the reason; it does not perform a file or agent configuration mutation.
package.jsonView on unpkg · L93The request helper sends caller-provided URL and options through fetch and returns the response; no fixed recipient or credential collection is established by this helper.
request-VRlU6wWt.mjsView on unpkg · L1The environment variable access checks NODE_ENV to expose development and production flags.
env-DQsuQljX.mjsView on unpkg · L1This report applies to @clicktap/state@3.3.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L93Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L93The preinstall hook only rejects a nested install and prints the reason; it does not perform a file or agent configuration mutation.
package.jsonView on unpkg · L93The request helper sends caller-provided URL and options through fetch and returns the response; no fixed recipient or credential collection is established by this helper.
request-VRlU6wWt.mjsView on unpkg · L1The environment variable access checks NODE_ENV to expose development and production flags.
env-DQsuQljX.mjsView on unpkg · L1