truffle-js

The package.json lifecycle script invokes require('child_process').execSync with a curl command at install time. Running curl through child_process during an npm install lifecycle hook causes any installer to execute remote content fetched over the network, without consent, as soon as `npm install` runs. The package name also resembles the widely-used 'truffle' Ethereum development toolkit, consistent with a typosquat lure. There is no legitimate reason for a small utility package to shell out to curl from its package.json install hook. ## Source: ossf-package-analysis (c190460255cf713f1797bacece635079c6d3db6a45a58199af29ab1acc9faa2f) The OpenSSF Package Analysis project identified 'truffle-js' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.