Loading npm security reports…
Simple PoC package for testing for dependency confusion vulnerabilities.
Installing the package automatically reports host identity and project location to an external webhook. This is unconsented install-time data exfiltration.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the current user name, working directory, and host name to an external webhook.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script contacts a known out-of-band callback or webhook service.
package.json#scripts.testView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.testView on unpkgThis report applies to ac-polyfills@2.10.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the current user name, working directory, and host name to an external webhook.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script contacts a known out-of-band callback or webhook service.
package.json#scripts.testView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.testView on unpkg