[potential Security Alert] New `site:develop` script added in `react-gplot@0.0.1`
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 591
- PR merge metrics
- No merged PRs in 30d
Description
A new `site:develop` script was detected in version `0.0.1` of the package `react-gplot`.
**Suspicion Score:** 13/100
**Script content:**
```
cross-env PORT=8080 gatsby develop --open -H 0.0.0.0
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.
Contributor guide
Research direction
Inspect the react-gplot@0.0.1 package metadata and its `site:develop` script first, then compare the script with the repository's expected development workflow. Confirm whether the command is intentional or dangerous, and document the evidence and any required follow-up in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100