[potential Security Alert] New `site:develop` script added in `react-gpplot@0.0.1`
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 591
- PR merge metrics
- No merged PRs in 30d
Description
A new `site:develop` script was detected in version `0.0.1` of the package `react-gpplot`.
**Suspicion Score:** 13/100
**Script content:**
```
cross-env PORT=8080 gatsby develop --open -H 0.0.0.0
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.
Contributor guide
Research direction
Start by reviewing the published package metadata for version 0.0.1 and its `site:develop` npm script, then compare the command with the linked npm scripts documentation and detector context. Done means determining whether the alert is an actual security issue and recording the investigation or required repository change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, react, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100