Loading npm security reports…
BUGBOUNTY PoC — represents @waves/navigation — @waves/navigation (in giving.js payment bundle) — Subsplash report 7a8faa0b
Installation automatically runs a preinstall hook that reports host-identifying data. This is an unconsented install-time action.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package metadata identifies @rutxploit-sec/waves-navigation version 1.0.0.
package.jsonView on unpkg · L2A preinstall hook runs inline Node code, collects the host name and local user name, and sends them to a loopback HTTP listener while suppressing errors.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkgThis report applies to @rutxploit-sec/waves-navigation@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package metadata identifies @rutxploit-sec/waves-navigation version 1.0.0.
package.jsonView on unpkg · L2A preinstall hook runs inline Node code, collects the host name and local user name, and sends them to a loopback HTTP listener while suppressing errors.
package.jsonView on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.preinstallView on unpkg