ClaudeRabbit
New scan
npmjs.com/package/is-primitive · 3.0.1+s

87/ 100

Low risk

Low risk in the install and entry runs Scanned 29 Oct 2026.

Watch how it happenedScan another
NetworkNone
No network calls
CodeNothing taken off
no code deduction

Score

87 / 100
1000

Nothing was taken off for what the code did or what running it showed.

What it did

32 events in 15.4s
Fetched2.4s
2833 bytes
Checked3.2s
0 locked dependencies, 0 malicious
Jev12.1s
Answered questions from the evidence
Sandbox12.1s
install completed, entry completed, 0 forged call(s)
Score12.3s
87 Low risk

Luna's report

Low risk, 87/100. Pin the exact version that was scanned and scan again before upgrading. Not verified: Behaviour outside the observed install and entry windows.

We installed the package and ran its entry point in a throwaway sandbox that answered every outbound call itself, and we scanned the code that install and import reach. The run recorded no contact outside package registries, no reads of the planted decoy credentials and no persistence writes. The code scan found no medium or high finding in reachable code.

What it ran

Installednpm · 1 package · 2.5s
Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC
NetworkNo calls
MachineDestroyed after the scan

Jev's answers

answered from the evidence
Install check
Install-time code does not use the network
Install-time code does not read credentials
Show all 5 answers
Install-time code does not run other programs or payloads
Install-time code is not obfuscated
Jev judged this code harmlesspackage.json
Docs check
The docs do not say it makes no network calls
The docs do not say it has no side effects
Show all 3 answers
What it did fits what its docs say it is for

Not verified

Behaviour outside the observed install and entry windows

Code paths not triggered by install or the entry point

Show all 4 items

Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses

The static scanner sandbox did not complete

Reputation

npmWeekly npm downloads: 4638096
npmFirst npm publish: 4416 days ago
npmNo maintainer change within 30 days
npmFirst published 12 years ago
npmnpm maintainers: doowb, jonschlinkert
npm4.6M weekly downloads

Shown apart from the code and behaviour findings.