Loading npm security reports…
BUGBOUNTY PoC — represents @subsplash/sentry — @subsplash/sentry (62 refs in bundles) — Subsplash report 7a8faa0b
Installing the package runs a preinstall script that beacons the local hostname and username to a loopback HTTP listener and hides script errors. Requiring the module only prints a dependency-confusion notice.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgnpm preinstall runs a node one-liner that reads the machine hostname and OS username and sends them in a GET query to http://127.0.0.1:8099, labeled as package @subsplash/sentry.
package.jsonView on unpkg · L7The same preinstall hook discards stderr with 2>/dev/null and prints a dependency-confusion execution banner.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgindex.js, loaded via main, logs that @subsplash/sentry was loaded from the public npm registry and exports an empty object.
index.jsView on unpkg · L1This report applies to @rutxploit-sec/subsplash-sentry@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgnpm preinstall runs a node one-liner that reads the machine hostname and OS username and sends them in a GET query to http://127.0.0.1:8099, labeled as package @subsplash/sentry.
package.jsonView on unpkg · L7The same preinstall hook discards stderr with 2>/dev/null and prints a dependency-confusion execution banner.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgindex.js, loaded via main, logs that @subsplash/sentry was loaded from the public npm registry and exports an empty object.
index.jsView on unpkg · L1