Use of software with malware In @innocarpe/deepseek-build
Description
The npm package's postinstall script (scripts/postinstall.js) requires child_process and issues POST requests carrying environment and host identifier data at install time. Installing the package causes automatic outbound network activity from a lifecycle hook that reads local process state, matching the shape of an install-time credential/host reconnaissance beacon rather than a documented build step.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version |
|---|---|---|
 npm |
Aliases
1. 2.