antvis / antvis/G2Plot

[potential Security Alert] New `site:develop` script added in `react-gpplot@0.0.1`

Open
#3,879 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2.7k
Forks
591
PR merge metrics
No merged PRs in 30d

Description

A new `site:develop` script was detected in version `0.0.1` of the package `react-gpplot`.

**Suspicion Score:** 13/100

**Script content:**
```
cross-env PORT=8080 gatsby develop --open -H 0.0.0.0
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the published package metadata for version 0.0.1 and its `site:develop` npm script, then compare the command with the linked npm scripts documentation and detector context. Done means determining whether the alert is an actual security issue and recording the investigation or required repository change.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, react, typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.