ClaudeRabbit
New scan
npmjs.com/package/is-even · 1.0.0+s

90/ 100

No threats observed

No threats observed: The package completed an observed install and entry-point run with no score deductions. Scanned 23 Oct 2026.

Watch how it happenedScan another
NetworkRegistry only
Registry traffic only
CodeNothing taken off
no code deduction

Score

90 / 100
1000

Nothing was taken off for what the code did or what running it showed.

What it did

43 events in 16.7s
Fetched0.3s
2163 bytes
Checked0.3s
0 locked dependencies, 0 malicious
Read9.6s
0 scanner finding(s)
Jev13.5s
Answered questions from the evidence
Sandbox13.5s
install completed, entry completed, 10 forged call(s)
Score13.9s
90 No threats observed

Network

nothing real left the machine
A
registry.npmjs.org
0 B sent in install
Forged dns
AAAA
registry.npmjs.org
0 B sent in install
Forged dns
GET
registry.npmjs.org/is-odd
0 B sent in install
Forged registry
GET
registry.npmjs.org/is-number
0 B sent in install
Forged registry
GET
registry.npmjs.org/kind-of
0 B sent in install
Forged registry
GET
registry.npmjs.org/is-buffer
0 B sent in install
Forged registry
Show all 10 calls
GET
registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz
0 B sent in install
Forged registry
GET
registry.npmjs.org/is-number/-/is-number-3.0.0.tgz
0 B sent in install
Forged registry
GET
registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz
0 B sent in install
Forged registry
GET
registry.npmjs.org/is-odd/-/is-odd-0.1.2.tgz
0 B sent in install
Forged registry

Luna's report

The result was No threats observed, but it covers only the tested version and run. Pin the scanned version. Behaviour outside the observed install and entry windows was not verified.

We installed the package and ran its entry point in a throwaway sandbox, and scanned the reachable code. The run completed with full coverage and no behaviour deductions.

What it ran

Installednpm · 5 packages · 3.5s
Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC
NetworkRegistry only
MachineDestroyed after the scan

Jev's answers

answered from the evidence
Install check
Install-time code uses the network
Install-time code does not read credentials
Show all 5 answers
Install-time code does not run other programs or payloads
Install-time code is not obfuscated
Jev judged this code harmlesspackage.json
Docs check
The docs do not say it makes no network calls
The docs do not say it has no side effects
Show all 3 answers
What it did fits what its docs say it is for

Not verified

Behaviour outside the observed install and entry windows

Code paths not triggered by install or the entry point

Show all 3 items

Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses

Reputation

npmWeekly npm downloads: 289300
npmFirst npm publish: 4259 days ago
npmNo maintainer change within 30 days
npmFirst published 11 years ago
npmnpm maintainers: jonschlinkert, doowb
npm289K weekly downloads

Shown apart from the code and behaviour findings.