This package is inert and published as a defensive placeholder. It exists
to reserve the tostpro name on the public npm registry and to demonstrate a
dependency-confusion exposure for an internal package of the same name.
No network access. No data collection. No persistence. No malicious behaviour of any kind. The only observable effects are:
console.log("test by abbishal") when the module is importedRCE_POC_MARKER.txt file written during npm installThe preinstall hook exists purely to demonstrate, for a security report,
that an attacker-controlled dependency would execute arbitrary commands on
install machines. It collects nothing and reports nothing.
FAQs
security holding package
The npm package tostpro receives a total of 54 weekly downloads. As such, tostpro popularity was classified as not popular.
We found that tostpro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.