Loading npm security reports…
Core JavaScript buffer utilities for Node.js
On npm installation, a hidden lifecycle hook fingerprints developer machines, contacts a remote host, decrypts a payload, and runs it detached. The advertised module API is unrelated hex conversion.
Package defines install-time lifecycle scripts.
package.jsonView on unpkginit.js fingerprints the host and username, then POSTs them to its hard-coded host.
init.jsView on unpkg · L113The install hook downloads and AES-GCM decrypts a remote blob, then writes it as Python.
init.jsView on unpkg · L123It starts the downloaded Python-derived program detached from npm.
init.jsView on unpkg · L152Package defines install-time lifecycle scripts.
package.jsonView on unpkginit.js fingerprints the host and username, then POSTs them to its hard-coded host.
init.jsView on unpkg · L113The install hook downloads and AES-GCM decrypts a remote blob, then writes it as Python.
init.jsView on unpkg · L123It starts the downloaded Python-derived program detached from npm.
init.jsView on unpkg · L152