@s4yhiitestpoc/scan-https-d
Advanced tools
Affected versions:
Research sample: postinstall sends a minimal install fingerprint over HTTPS to a researcher-controlled endpoint. No credentials or environment variables are read.
Research sample for a study of npm's publish-time scanning behaviour.
From postinstall, sends a small JSON document over HTTPS to an endpoint
operated by the maintainer, then exits. The document contains the package name
and version, the resolved registry URL, the install directory, hostname,
username, platform and local interface addresses.
It does not read environment variables, process arguments, files, credentials or cloud metadata, does not spawn a shell and does not persist anything.
This variant carries NO dual-use declaration. Its counterpart scan-https-e
carries an identical payload plus contentPolicy metadata and a DISCLOSURE
file, so the two together isolate the effect of the declaration on the scanner
verdict.
Maintainer: s4yhii__ (security researcher). Not intended for production use.
FAQs
security holding package
The npm package @s4yhiitestpoc/scan-https-d receives a total of 363 weekly downloads. As such, @s4yhiitestpoc/scan-https-d popularity was classified as not popular.
We found that @s4yhiitestpoc/scan-https-d demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.
