Loading npm security reports…
BUGBOUNTY PoC — represents @waves/icons — @waves/icons (4 refs) — Subsplash report 7a8faa0b
On npm install, the preinstall hook collects the machine hostname and local username and beacons them to 127.0.0.1:8099, labeled as the foreign package @waves/icons. Import only prints a dependency-confusion line.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall script runs node, reads os.hostname and os.userInfo().username, and sends them in an HTTP GET to http://127.0.0.1:8099 while discarding stderr.
package.jsonView on unpkg · L7package.json names the package @rutxploit-sec/waves-icons and describes it as standing in for the unrelated package @waves/icons.
package.jsonView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgindex.js prints a dependency-confusion marker when the module is loaded and exports an empty object.
index.jsView on unpkg · L1This report applies to @rutxploit-sec/waves-icons@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall script runs node, reads os.hostname and os.userInfo().username, and sends them in an HTTP GET to http://127.0.0.1:8099 while discarding stderr.
package.jsonView on unpkg · L7package.json names the package @rutxploit-sec/waves-icons and describes it as standing in for the unrelated package @waves/icons.
package.jsonView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgindex.js prints a dependency-confusion marker when the module is loaded and exports an empty object.
index.jsView on unpkg · L1