Loading npm security reports…
Authorized dep-confusion canary. H1 program verily_life_sciences, report #<ID>. Contact: nimbusedge@wearehackerone.com
Installing the package triggers a preinstall hook that transmits system identity and environment details. The request uses unencrypted HTTP to an external canary endpoint.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook collects host and identity information and sends it to an external HTTP endpoint.
package.jsonView on unpkg · L6The manifest labels the package a dependency-confusion canary, consistent with intentional install-time telemetry collection.
package.jsonView on unpkg · L4Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThis report applies to @nimbusedge/analytics@11111.1.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook collects host and identity information and sends it to an external HTTP endpoint.
package.jsonView on unpkg · L6The manifest labels the package a dependency-confusion canary, consistent with intentional install-time telemetry collection.
package.jsonView on unpkg · L4Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg