Loading npm security reports…
fetch all crypto prices
On npm install, the package reads the installing project's `.env` and sends its parsed contents to an obfuscated remote endpoint. Failures are deliberately suppressed so installation succeeds.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkgThe library reads and parses `.env`, then POSTs all parsed values as JSON.
dist/index.jsView on unpkg · L50The library reads and parses `.env`, then POSTs all parsed values as JSON.
dist/index.jsView on unpkg · L67Install hook calls `prices()`, which uploads the installing project's `.env` when present.
dist/postinstall.jsView on unpkg · L3Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L19Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L19The library reads and parses `.env`, then POSTs all parsed values as JSON.
dist/index.jsView on unpkg · L50The library reads and parses `.env`, then POSTs all parsed values as JSON.
dist/index.jsView on unpkg · L67Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkgInstall hook calls `prices()`, which uploads the installing project's `.env` when present.
dist/postinstall.jsView on unpkg · L3