Loading npm security reports…
Security research
Installing the package automatically reports host identity to an external endpoint. This is an unconsented install-time data disclosure.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the installing host's hostname and current user name to an external server.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgThe package has no functional runtime code that would require this install-time network request.
index.jsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe automatic preinstall hook sends the installing host's hostname and current user name to an external server.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgThe package has no functional runtime code that would require this install-time network request.
index.jsView on unpkg · L1