Multiple npm packages including es5-ext and styled-components added post-install messages directed at Russian/Belarusian users protesting the Ukraine invasion. The behavior was non-destructive but constituted unexpected behavior in dependencies.
PACKAGE_INSTALL_SCRIPTS detects anomalous postinstall messages
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Partial | PACKAGE_INSTALL_SCRIPTS detects anomalous postinstall messages |
| Socket | Partial | May detect install script anomaly |
| Snyk | Missed | No capability for this attack class |
| Sonatype (Nexus) | Missed | No capability for this attack class |
| Black Duck | Missed | No capability for this attack class |
| Endor Labs | Missed | No capability for this attack class |