Loading npm security reports…
A benign placeholder for npm.
Installing the package triggers hidden outbound host fingerprinting before and after installation.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the current user, host name, working directory, and timestamp to a remote host.
package.jsonView on unpkg · L10The same host fingerprint callback runs again automatically after installation.
package.jsonView on unpkg · L11The callback suppresses failures, making the outbound activity less visible to installers.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the current user, host name, working directory, and timestamp to a remote host.
package.jsonView on unpkg · L10The same host fingerprint callback runs again automatically after installation.
package.jsonView on unpkg · L11The callback suppresses failures, making the outbound activity less visible to installers.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkg