OSV ID
MAL-2026-14277
Ecosystem
npm
Summary
The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function. This is the shape of an install/import-time execution payload rather than an API a caller must opt into.
Source: amazon-inspector (a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.