Loading npm security reports…
A benign placeholder for npm.
Automatic npm lifecycle hooks exfiltrate host-identifying installation metadata twice. The requests are silent and use unencrypted HTTP.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the current username, hostname, working directory, and timestamp to an external HTTP host.
package.jsonView on unpkg · L10The same hidden telemetry request runs again in postinstall, with failures suppressed.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the current username, hostname, working directory, and timestamp to an external HTTP host.
package.jsonView on unpkg · L10The same hidden telemetry request runs again in postinstall, with failures suppressed.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkg