Note: This report is updated by a verification record
Malicious post-install script combined with low project popularity indicates potential malware. Arbitrary code execution is a major concern.
The package is marked as malware by OSV: MAL-2026-2410 with source: amazon-inspector
Note: This report is updated by a verification record
The package exhibits suspicious behavior. The post-install script executes node -e "try{require('.')}catch(e){}", which attempts to require the current directory. This can lead to arbitrary code execution, a common malware technique. Additionally, the project has low popularity and few published versions, raising further concerns. While each of these individually might not be conclusive, the combination suggests malicious intent.
