Loading npm security reports…
BUGBOUNTY PoC — represents @subsplash/thoughtspot — @subsplash/thoughtspot (3 refs) — Subsplash report 7a8faa0b
An install-time hook automatically reports local system identity data to a local HTTP endpoint. No user action after dependency installation is needed.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package identifies itself as a public-package dependency-confusion proof of concept targeting @subsplash/thoughtspot.
package.jsonView on unpkg · L2Its automatic preinstall hook collects the local hostname and username and sends them to an HTTP listener before installation completes.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThis report applies to @rutxploit-sec/subsplash-thoughtspot@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package identifies itself as a public-package dependency-confusion proof of concept targeting @subsplash/thoughtspot.
package.jsonView on unpkg · L2Its automatic preinstall hook collects the local hostname and username and sends them to an HTTP listener before installation completes.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkg