Loading npm security reports…
BUGBOUNTY PoC — represents @waves/input — @waves/input (2 refs) — Subsplash report 7a8faa0b
An install-time lifecycle hook collects host identity data and transmits it over HTTP. This is an active automatic data-send operation.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe metadata identifies the reviewed package and release.
package.jsonView on unpkg · L2The preinstall hook gathers the machine hostname and account name, then sends them to a local HTTP endpoint automatically during installation.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThis report applies to @rutxploit-sec/waves-input@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe metadata identifies the reviewed package and release.
package.jsonView on unpkg · L2The preinstall hook gathers the machine hostname and account name, then sends them to a local HTTP endpoint automatically during installation.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkg