Loading npm security reports…
Security research
Installation triggers an unconsented network request that discloses local host identity. The package has no functional runtime implementation that explains this behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook automatically sends the installing host name and current user to a remote HTTP endpoint.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook automatically sends the installing host name and current user to a remote HTTP endpoint.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkg