Loading npm security reports…
A benign placeholder for npm.
Installing the package triggers two silent external callbacks. They disclose host and project-location metadata without user action.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPreinstall and postinstall automatically send the current username, hostname, working directory, and timestamp to an external host.
package.jsonView on unpkg · L10The callbacks suppress output and ignore failures, making the collection silent during installation.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPreinstall and postinstall automatically send the current username, hostname, working directory, and timestamp to an external host.
package.jsonView on unpkg · L10The callbacks suppress output and ignore failures, making the collection silent during installation.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkg