antvis / antvis/G2Plot

[potential Security Alert] New `site:develop` script added in `react-gplot@0.0.1`

Open
#3,880 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2.7k
Forks
591
PR merge metrics
No merged PRs in 30d

Description

A new `site:develop` script was detected in version `0.0.1` of the package `react-gplot`.

**Suspicion Score:** 13/100

**Script content:**
```
cross-env PORT=8080 gatsby develop --open -H 0.0.0.0
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.

Contributor guide

Open the contributing guide

Research direction

Inspect the react-gplot@0.0.1 package metadata and its `site:develop` script first, then compare the script with the repository's expected development workflow. Confirm whether the command is intentional or dangerous, and document the evidence and any required follow-up in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.