Loading npm security reports…
BUGBOUNTY PoC — represents @waves/button — @waves/button (in giving.js payment bundle) — Subsplash report 7a8faa0b
Installation automatically executes a hidden inline script. It collects local host and user identifiers and transmits them to a local HTTP listener.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook runs inline Node code that reads the local hostname and account name, then sends them in an HTTP request during installation.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThis report applies to @rutxploit-sec/waves-button@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook runs inline Node code that reads the local hostname and account name, then sends them in an HTTP request during installation.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkg