Loading npm security reports…
A postinstall hook runs Node that reads /tmp/flag.txt and sends the contents to an ngrok-free.app URL owned by the package. Failures are ignored so the install still looks successful. There is no library implementation beyond this hook.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgAutomatic postinstall runs inline Node on install.
package.jsonView on unpkg · L6The hook reads /tmp/flag.txt from the host filesystem.
package.jsonView on unpkg · L8File contents are sent to a package-controlled ngrok-free.app URL as the flag query parameter.
package.jsonView on unpkg · L8Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
package.json#scripts.postinstallView on unpkg · L1Source appears to send environment or credential material to an external endpoint.
package.json#scripts.postinstallView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.postinstallView on unpkgThis report applies to sorrawit-dev-helper@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgAutomatic postinstall runs inline Node on install.
package.jsonView on unpkg · L6The hook reads /tmp/flag.txt from the host filesystem.
package.jsonView on unpkg · L8File contents are sent to a package-controlled ngrok-free.app URL as the flag query parameter.
package.jsonView on unpkg · L8Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
package.json#scripts.postinstallView on unpkg · L1Source appears to send environment or credential material to an external endpoint.
package.json#scripts.postinstallView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.json#scripts.postinstallView on unpkg