Loading npm security reports…
BUGBOUNTY PoC — represents @subsplash/google-tag-manager — @subsplash/google-tag-manager (8 refs) — Subsplash report 7a8faa0b
An automatic install hook collects host identity data and makes an HTTP request. The package presents itself as a dependency-confusion proof of concept.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest defines a preinstall hook that runs inline Node code automatically during installation.
package.jsonView on unpkg · L5The manifest defines a preinstall hook that runs inline Node code automatically during installation.
package.jsonView on unpkg · L7That hook reads the machine hostname and current operating-system username, then sends them to a local HTTP endpoint.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThe declared main entrypoint only logs that the package was loaded from public npm as a dependency-confusion event.
index.jsView on unpkg · L1This report applies to @rutxploit-sec/subsplash-google-tag-manager@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest defines a preinstall hook that runs inline Node code automatically during installation.
package.jsonView on unpkg · L5The manifest defines a preinstall hook that runs inline Node code automatically during installation.
package.jsonView on unpkg · L7That hook reads the machine hostname and current operating-system username, then sends them to a local HTTP endpoint.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThe declared main entrypoint only logs that the package was loaded from public npm as a dependency-confusion event.
index.jsView on unpkg · L1