@maps4html/mapml@0.18.1
Custom <mapml-viewer> element suite
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package’s postinstall hook automatically runs Playwright’s browser installer, initiating downloads during installation for unrelated test tooling. The package’s web mapping purpose and Playwright development dependency explain why the command may be present, but do not make the automatic installation-time contact part of the package’s runtime function.
Decision evidence
public snapshot- The package runs `npx playwright install` automatically from its `postinstall` hook, triggering installation-time browser downloads unrelated to the map viewer’s purpose.
- The package describes itself as a web mapping component.
- Playwright is declared as development tooling, which suggests the browser installation supports testing.
Source & flagged code
5 flaggedTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs `npx playwright install` automatically from its `postinstall` hook, triggering installation-time browser downloads unrelated to the map viewer’s purpose.
package.jsonView on unpkg · L34Findings
Affected versions and remediation
This report applies to @maps4html/mapml@0.18.1.
See all versions of @maps4html/mapml for other recorded verdicts.
- Avoid installing @maps4html/mapml@0.18.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.