enbd-react-error-boundry
A utility package that reports runtime errors to Sentry using @sentry/node.
This report shows the evidence for enbd-react-error-boundry@6.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms concrete install-time network exfiltration to a hardcoded Sentry DSN via package.json preinstall and examples/verify.js. This is unconsented lifecycle execution of telemetry collection, so the package should be blocked.
Decision evidence
public snapshot- package.json defines preinstall: npm install @sentry/node && node examples/verify.js
- examples/verify.js runs during install, calls init(), setUserFromPublicIp(), check(), and flush()
- src/index.js has a hardcoded default Sentry DSN for o4510485815754752.ingest.us.sentry.io
- src/index.js defaults sendDefaultPii: true and can attach public IP via setUserFromPublicIp
- examples/verify.js deliberately throws an error and flushes it to Sentry during preinstall
- No child_process usage beyond manifest lifecycle command observed in source files
- No filesystem writes, agent config mutation, persistence files, or destructive code found
- Runtime API is otherwise package-aligned error reporting when explicitly used
Source & flagged code
4 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.jsFindings
Affected versions and remediation
This report applies to enbd-react-error-boundry@6.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing enbd-react-error-boundry@6.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.