Destructive action in npm packages.

Oct 22, 2026

The manifest activates a postinstall hook that automatically deletes qualifying older DocNexus workspace data without migration or an affirmative user action. This is concrete install-tim...

Oct 21, 2026

The package has no automatic install hook, but its exposed setup command performs unconfirmed deletion of a named Docker volume. That destructive effect supports blocking publication.

Oct 20, 2026

The startup deletion is an unguarded destructive side effect on the consumer’s plugin storage. Although compatibility cleanup is possible, the inspected source provides no condition or ex...