Loading npm security reports…
Common utilities for CryptoBot - TON wallet integration
Both install hooks harvest credentials and system information without user action, then transmit them to an external host. The postinstall hook broadens collection to common host directories.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstallation automatically runs both collection scripts.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe hooks collect sensitive environment variables and send a JSON payload to attacker.com over HTTPS.
preinstall.jsView on unpkg · L95The postinstall code configures attacker.com as its C2 exfiltration endpoint.
postinstall.jsView on unpkg · L11This report applies to cr-bot-common@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstallation automatically runs both collection scripts.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe hooks collect sensitive environment variables and send a JSON payload to attacker.com over HTTPS.
preinstall.jsView on unpkg · L95The postinstall code configures attacker.com as its C2 exfiltration endpoint.
postinstall.jsView on unpkg · L11