“A tiny (118 bytes), secure URL-friendly unique string ID generator”
Local reference
Suspicious dependency
Inferred
Mal-ecule
H₂(OsPo)Md₂(Pa₃)
Referenced by 8 samples
- hostile ruvnet-ruflo.tar.gz fetched
- hostile github.com-typehero-typehero-v0.0.0-20260718191631-b8fa799cf085.zip fetched
- hostile ruvnet-ruflo.tar.gz fetched
- hostile github.com-satont-tsuwari-v4.10.3-0.20260808160456-ebb2a065cdf9+incompatible.zip fetched
- benign github.com-comfy-org-comfyui_frontend-v1.27.3.zip fetched
- hostile github.com-satont-twir-v2.6.2+incompatible.zip fetched
- benign github.com-twirapp-twir-v0.0.0-20260809155406-d5ba5bd91fb9.zip fetched
- hostile github.com-satont-tsuwari-v4.3.6+incompatible.zip fetched
Objectives
component severity, 80% confident.
supply-chain/install-hook/package
Repository uses GitHub shorthand format
Micro-behaviors
notable severity, 96% confident.
os/random
Generates Web Crypto random bytes
notable severity, 80% confident.
process/io
References Node.js stdout stream
baseline severity, 90% confident.
data
Constructs a Uint8Array buffer
baseline severity, 80% confident.
process/info
Reads Node.js arguments through process.argv
Metadata
notable severity, 95% confident.
file/profile
README links to a translated README
notable severity, 90% confident.
package/manifest
Repository uses owner/project coordinate
baseline severity, 99% confident.
lang
TypeScript declaration file
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 90% confident.
package/dependencies
npm manifest omits dependencies field
baseline severity, 95% confident.
package/files
Manifest sits at npm publish root
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 84% confident.
build
Member under bin/native/prebuilds dir
component severity, 100% confident.
file
High comment-to-code ratio
component severity, 100% confident.
file/extension
File uses a source declaration extension
component severity, 85% confident.
package/testing/presence
File is a test or type-declaration source file
Identity
| SHA-256 | 8291903356805ef5dc1481c8bd3dc426b4021fa1ec40cd683e5f59253a212daf |
|---|---|
| Canonical SHA-256 | 0ff6f67c7f10cf49f031faf20f5b2d4196b3b9232348ed7496cc66c70f47f284 |
| Filename | nanoid-5.1.5.tgz |
| Package | nanoid |
| Version | 5.1.5 |
| PURL | pkg:npm/[email protected] |
Origin
| Source | upload |
|---|---|
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/nanoid/-/nanoid-5.1.5.tgz |
Timeline
| First seen | 12 Aug 2026 00:04 UTC |
|---|---|
| First analyzed | 12 Aug 2026 00:18 UTC |
| Last analyzed | 28 Aug 2026 00:08 UTC |
| Last updated | 28 Aug 2026 00:13 UTC |
Labeling
| Label | unknown |
|---|---|
| Label source | upload |
| Traits version | 59a44 |
Not seeing what you expected? Let us know