Git dependency
Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.
HTTP dependency
Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.
Known malware
This package is malware. We have asked the package registry to remove it.
Possible typosquat attack
Package name is similar to other popular packages and may not be the package you want.
AI detected potential malware
AI has identified this package as malware. This is a strong signal that the package may be malicious.
GitHub dependency
Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.
Install scripts
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Non-existent author
The package was published by an npm account that no longer exists.
NPM Shrinkwrap
Package contains a shrinkwrap file. This may allow the package to bypass normal install procedures.
Obfuscated code
Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware
Protestware or potentially unwanted behavior
This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.
Telemetry
This package contains telemetry which tracks how it is used.
Unstable ownership
A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.
AI detected security risk
AI has determined that this package may contain potential security issues or vulnerabilities.
Manifest confusion
This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.
Native code
Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.
Network access
This module accesses the network.
New author
A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Potential vulnerability
Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.
Shell access
This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Trivial Package
Packages less than 10 lines of code are easily copied into your own project and may not warrant the additional supply chain risk of an external dependency.
Uses eval
Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
AI detected anomaly
AI has identified unusual behaviors that may pose a security risk.
Chronological version anomaly
Semantic versions published out of chronological order.
Debug access
Uses debug, reflection and dynamic code execution features.
Dynamic require
Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Environment variable access
Package accesses environment variables, which may be a sign of credential stuffing or data theft.
Filesystem access
Accesses the file system, and could potentially read sensitive data.
High entropy strings
Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.
Floating dependency
Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.
Unpopular package
This package is not very popular.
Bad dependency semver
Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.
Minified code
This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.
Deprecated
The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.
Unmaintained
Package has not been updated in more than 5 years and may be unmaintained. Problems with the package may go unaddressed.
Critical CVE
Contains a Critical Common Vulnerability and Exposure (CVE).
High CVE
Contains a high severity Common Vulnerability and Exposure (CVE).
Medium CVE
Contains a medium severity Common Vulnerability and Exposure (CVE).
Low CVE
Contains a low severity Common Vulnerability and Exposure (CVE).
Explicitly Unlicensed Item
(Experimental) Something was found which is explicitly marked as unlicensed
Nonpermissive License
(Experimental) A package's licensing information has fine-grained problems
Copyleft License
(Experimental) Copyleft license information was found
Deprecated license
(Experimental) License is deprecated which may have legal implications regarding the package's use.
Deprecated SPDX exception
(Experimental) Contains a known deprecated SPDX license exception.
Legal notice
(Experimental) Package contains a legal notice. This could increase your exposure to legal risk when using this project.
No License Found
(Experimental) License information could not be found
Non OSI license
(Experimental) Package has a non-OSI-approved license.
Non-permissive License
(Experimental) A license not known to be considered permissive was found
Unidentified License
(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license