npmjs.com/package/next · 16.4.3+

85/ 100

Low risk

Low risk: The observed run produced no reported findings in the score breakdown. Scanned 23 Oct 2026.

Watch how it happened Scan another

NetworkRegistry only

Registry traffic only

CodeNothing taken off

no code deduction

Score

85 / 100

1000

Nothing was taken off for what the code did or what running it showed.

What it did

115 events in 61.3s

Fetched1.6s

43608539 bytes

Checked15.0s

0 locked dependencies, 0 malicious

Read33.3s

0 scanner finding(s)

Jev57.3s

Answered questions from the evidence

Sandbox57.3s

install completed, entry completed, 80 forged call(s)

Score57.7s

85 Low risk

Network

nothing real left the machine

registry.npmjs.org

0 B sent in install

Forged dns

AAAA

registry.npmjs.org

0 B sent in install

Forged dns

GET

registry.npmjs.org/@opentelemetry%2fapi

0 B sent in install

Forged registry

GET

registry.npmjs.org/@playwright%2ftest

0 B sent in install

Forged registry

GET

registry.npmjs.org/babel-plugin-react-compiler

0 B sent in install

Forged registry

GET

registry.npmjs.org/react

0 B sent in install

Forged registry

Show all 80 calls

GET

registry.npmjs.org/react-dom

0 B sent in install

Forged registry

GET

registry.npmjs.org/sass

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fenv

0 B sent in install

Forged registry

GET

registry.npmjs.org/@swc%2fhelpers

0 B sent in install

Forged registry

GET

registry.npmjs.org/baseline-browser-mapping

0 B sent in install

Forged registry

GET

registry.npmjs.org/caniuse-lite

0 B sent in install

Forged registry

GET

registry.npmjs.org/postcss

0 B sent in install

Forged registry

GET

registry.npmjs.org/styled-jsx

0 B sent in install

Forged registry

GET

registry.npmjs.org/sharp

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-darwin-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-darwin-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-linux-arm64-gnu

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-linux-arm64-musl

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-linux-x64-gnu

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-linux-x64-musl

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-win32-arm64-msvc

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next%2fswc-win32-x64-msvc

0 B sent in install

Forged registry

GET

registry.npmjs.org/scheduler

0 B sent in install

Forged registry

GET

registry.npmjs.org/tslib

0 B sent in install

Forged registry

GET

registry.npmjs.org/nanoid

0 B sent in install

Forged registry

GET

registry.npmjs.org/picocolors

0 B sent in install

Forged registry

GET

registry.npmjs.org/source-map-js

0 B sent in install

Forged registry

GET

registry.npmjs.org/semver

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fcolour

0 B sent in install

Forged registry

GET

registry.npmjs.org/detect-libc

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-arm

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-win32-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-darwin-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-win32-ia32

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-ppc64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-s390x

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-win32-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-darwin-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linux-riscv64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linuxmusl-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-freebsd-wasm32

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-linuxmusl-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-arm

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-darwin-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-ppc64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-s390x

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-darwin-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-webcontainers-wasm32

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linux-riscv64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linuxmusl-x64

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-libvips-linuxmusl-arm64

0 B sent in install

Forged registry

GET

registry.npmjs.org/client-only

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img%2fsharp-wasm32

0 B sent in install

Forged registry

GET

registry.npmjs.org/@emnapi%2fruntime

0 B sent in install

Forged registry

GET

registry.npmjs.org/client-only/-/client-only-0.0.1.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/semver/-/semver-7.8.5.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next/swc-linux-x…ux-x64-gnu-16.4.3.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img/sharp-linux-…-linux-x64-0.35.5.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@next/env/-/env-16.4.3.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/react-dom/-/react-dom-19.3.1.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img/sharp-libvip…s-linux-x64-1.3.4.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/tslib/-/tslib-2.8.1.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/baseline-browser-…r-mapping-2.11.31.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/sharp/-/sharp-0.35.5.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/caniuse-lite/-/ca…lite-1.0.30001819.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/postcss/-/postcss-8.5.23.tgz

0 B sent in install

Forged registry

GET

registry.npmjs.org/react/-/react-19.3.1.tgz

0 B sent in install

Forged registry

Luna's report

This result is Low risk. Pin the scanned version before using it. Behaviour outside the observed install and entry windows was not verified.

We installed the package, ran its entry point in a throwaway sandbox and scanned the code. The run was observed, and the score breakdown listed no behaviour findings.

What it ran

Installednpm · 22 packages · 26.3s

Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC

NetworkRegistry only

MachineDestroyed after the scan

Jev's answers

answered from the evidence

Install check

Install-time code uses the network

Install-time code does not read credentials

Show all 5 answers

Install-time code does not run other programs or payloads

Install-time code is not obfuscated

Jev judged this code harmlesspackage.json

Docs check

The docs do not say it makes no network calls

The docs do not say it has no side effects

Show all 3 answers

What it did fits what its docs say it is for

Flagged code check

Jev judged this code harmless

Not verified

Behaviour outside the observed install and entry windows

Code paths not triggered by install or the entry point

Show all 6 items

Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses

Flagged code that was read but never seen doing anything in the sandbox, so it takes no points: 6 reachable finding location(s), -72 floored at -40. (-12: Code hides a long string in hex escapes at dist/compiled/@vercel/og/index.edge.js:12641 (import); -12: Code hides a long string in hex escapes at dist/compiled/@vercel/og/index.edge.js:12649 (import); -12: Code hides a long string in hex escapes at dist/compiled/@vercel/og/index.edge.js:12657 (import))

Reputation signal unavailable: npm download counts

Key-shaped strings in 1 file, never seen leaving the machine

Reputation

npmFirst npm publish: 5583 days ago

npmNo maintainer change within 30 days

npmFirst published 15 years ago

npmnpm maintainers: vercel-release-bot, matt.straka, matheuss, zeit-bot

Not checked: npm download counts.

Reputation warnings are shown on their own and do not lower the code score.

Shown apart from the code and behaviour findings.