Loading npm security reports…
Internal automation library.
Automatic npm preinstall and install hooks collect local identity and directory metadata, then send encoded values to a callback domain. The empty runtime entrypoint does not mitigate install-time exfiltration.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPreinstall collects username, hostname, working directory, and package name.
package.jsonView on unpkg · L7The hook exfiltrates encoded host data through HTTPS and DNS.
package.jsonView on unpkg · L7Install repeats the same automatic collection and network callbacks.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPreinstall collects username, hostname, working directory, and package name.
package.jsonView on unpkg · L7The hook exfiltrates encoded host data through HTTPS and DNS.
package.jsonView on unpkg · L7Install repeats the same automatic collection and network callbacks.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg