OSV ID
MAL-2026-17902
Ecosystem
npm
Summary
Review of parxleys@1.0.1 did not surface any code paths associated with supply-chain attack behavior: no install-time or import-time network fetch, no lifecycle script that downloads or executes remote content, no reads of installer secret paths (such as ~/.aws, ~/.ssh, ~/.npmrc, or browser/wallet stores), no environment-variable scraping, no hardcoded author-controlled exfiltration endpoint, no backdoor or reverse-shell mechanism, and no shipped third-party credentials or registry-redirect configuration. The package exposes no behavior that would route installer data outward or run attacker-controlled code on install or require.
Source: amazon-inspector (7c6385ac9e557c4028ed62c213d8f08d21d4a11ba01be0e41d847888e268f3f8)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.