posteahora@1.0.0

CAUTION

Publisher claims: "Social media scheduling & publishing CLI — plan, schedule and publish posts across 16 networks: Instagram, TikTok, YouTube, X (Twitter), Facebook, LinkedIn, Threads, Bluesky, Mastodon, Discord, Telegram, WordPress, Dev.to, Tumblr, Pinterest and Google Business, powered by PosteAhora." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sashadiz · joined 1 days agoInstalls 578Last detonated 25 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageHOW_TO_RUN.md:24 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageHOW_TO_RUN.md:23 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:31 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageHOW_TO_RUN.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:63 · npx invocation of non-well-known package — may execute untrusted code

AST06