Loading npm security reports…
Simple PoC package for testing for dependency confusion vulnerabilities.
Installing the package automatically invokes wget and transmits host-identifying values. The callback is unrelated to the package's exported runtime behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the current user, working directory, and hostname to a third-party webhook.
package.jsonView on unpkg · L8The test script repeats the same host-fingerprinting callback.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script contacts a known out-of-band callback or webhook service.
package.json#scripts.testView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.testView on unpkgThe README describes the package as a dependency-confusion proof of concept; that self-description does not negate the automatic callback.
README.mdView on unpkg · L1This report applies to bender-rspack-config@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the current user, working directory, and hostname to a third-party webhook.
package.jsonView on unpkg · L8The test script repeats the same host-fingerprinting callback.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script contacts a known out-of-band callback or webhook service.
package.json#scripts.testView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.testView on unpkgThe README describes the package as a dependency-confusion proof of concept; that self-description does not negate the automatic callback.
README.mdView on unpkg · L1