@newspage/libx-amount@99.99.42
A simple placeholder for npm.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected source establishes an automatic, unguarded disclosure of host and user identifiers to a fixed external recipient when the package entry file loads. This concrete data transfer supports blocking publication.
Decision evidence
public snapshot- The package entry points to a command-like main value, and both install lifecycle commands are empty.
- Loading the entry file automatically sends host and user identifiers to a fixed external host.
- The request includes those identifiers encoded in its query string.
Source & flagged code
8 flagged · loading sourceReview focus: Node CommonJS falls back to root index.js when main points to a missing file and exports is absent. An invalid main string does not alone make index.js inert.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package entry points to a command-like main value, and both install lifecycle commands are empty.
package.jsonView on unpkg · L5Findings
Affected versions and remediation
This report applies to @newspage/libx-amount@99.99.42.
See all versions of @newspage/libx-amount for other recorded verdicts.
- Avoid installing @newspage/libx-amount@99.99.42. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.