OSV ID
MAL-2026-10695
Ecosystem
npm
Summary
The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant ( const GEMINI_KEY = "AQ.Ab8RN6..."; ) and calls https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=<KEY> from the browser when the user clicks the chat button. The key belongs to the package author's own Google account. There are no npm lifecycle scripts (no preinstall/install/postinstall/prepare), and main points at the HTML file, so nothing executes on npm install or require() . The key is not a third-party credential being distributed to installers, nor does the code read or exfiltrate any installer-side data; the only consequence of using the package is that requests consume the author's own Gemini quota.
Source: amazon-inspector (8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.