Loading npm security reports…
catqrcodeconverter (dependency-confusion PoC)
A lifecycle payload exfiltrates host-identifying data during package installation. No user action beyond installing the package is required.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstallation automatically runs the payload before and after install.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource collects local host identity data and sends it to an external endpoint.
scripts/run.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
scripts/run.jsView on unpkgThis report applies to catqrcodeconverter@99.2.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
The payload collects the local username and hostname, then posts them to an external webhook.
scripts/run.jsView on unpkg · L21Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstallation automatically runs the payload before and after install.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource collects local host identity data and sends it to an external endpoint.
scripts/run.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
scripts/run.jsView on unpkgThe payload collects the local username and hostname, then posts them to an external webhook.
scripts/run.jsView on unpkg · L21