Loading npm security reports…
Security research - Dependency Confusion PoC - bug bounty disclosure
Installing the package automatically collects host identity and environment context. It transmits that data to a third-party endpoint without user consent.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs postinstall.js automatically after npm installation.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource collects local host identity data and sends it to an external endpoint.
postinstall.jsView on unpkg · L4The install script collects the hostname, local username, platform, current directory, and Node version.
postinstall.jsView on unpkg · L11It base64-encodes the collected host data and sends it to an external requestcatcher host.
postinstall.jsView on unpkg · L25Comments frame the behavior as harmless security research while the code performs unconsented host-data exfiltration.
postinstall.jsView on unpkg · L1This report applies to @umschool/analytics@999.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs postinstall.js automatically after npm installation.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource collects local host identity data and sends it to an external endpoint.
postinstall.jsView on unpkg · L4The install script collects the hostname, local username, platform, current directory, and Node version.
postinstall.jsView on unpkg · L11It base64-encodes the collected host data and sends it to an external requestcatcher host.
postinstall.jsView on unpkg · L25Comments frame the behavior as harmless security research while the code performs unconsented host-data exfiltration.
postinstall.jsView on unpkg · L1