“A tiny (118 bytes), secure URL-friendly unique string ID generator”
Local reference
Suspicious dependency
Inferred
Mal-ecule
H(Po)Md₂(Pa₃)
Referenced by 2 samples
Objectives
component severity, 80% confident.
supply-chain/install-hook/package
Repository uses GitHub shorthand format
Micro-behaviors
notable severity, 80% confident.
process/io
References Node.js stdout stream
baseline severity, 90% confident.
data
Constructs a Uint8Array buffer
baseline severity, 80% confident.
process/info
Reads Node.js arguments through process.argv
Metadata
notable severity, 95% confident.
file/profile
README links to a translated README
notable severity, 90% confident.
package/manifest
Package declares TypeScript types entry
baseline severity, 99% confident.
lang
TypeScript declaration file
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 90% confident.
package/dependencies
npm manifest omits dependencies field
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 100% confident.
file/extension
File uses a source declaration extension
component severity, 85% confident.
package/testing/presence
File is a test or type-declaration source file
Identity
| SHA-256 | fccc374f295c96eb6041eab120e24f0298121c9c114448d938aaaa2c04538486 |
|---|---|
| Canonical SHA-256 | 0ff6f67c7f10cf49f031faf20f5b2d4196b3b9232348ed7496cc66c70f47f284 |
| Filename | [email protected] |
| Package | nanoid |
| Version | 5.1.3 |
| PURL | pkg:npm/[email protected] |
Origin
| Source | x |
|---|---|
| Feed | wolfi.dev |
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/nanoid/-/nanoid-5.1.3.tgz |
Timeline
| First seen | 23 Aug 2026 22:51 UTC |
|---|---|
| First analyzed | 23 Aug 2026 22:49 UTC |
| Last analyzed | 24 Aug 2026 21:28 UTC |
| Last updated | 24 Aug 2026 21:31 UTC |
Labeling
| Label | unknown |
|---|---|
| Traits version | b8c1c |
Not seeing what you expected? Let us know