This package is a liability

It constantly triggers vulnerabilities of different severity levels by rotating installs of vulnerable packages. New versions are released every 60+ minutes.

if you make the mistake of executing

npm install liability

you can use this package to test your monitoring tools such as your Dependabot configuration.

Due to the frequent updates, you probably want to screen for outdated and deprecated packages as well. Some useful commands to handle this liability are npm audit, npm outdated and npm update. For more help, check out the npm cli commands.

Manual testing

If you don't like constant insecurity updates you might want to explicitly install a specific version of this package to test for the respective "feature":

| feature | install command | | --------------------------------- | ------------------------------------------------- | | low severity vulnerability | npm i [email protected] | | moderate severity vulnerability | npm i [email protected] | | high severity vulnerability | npm i [email protected] | | critical severity vulnerability | npm i [email protected] | | deprecated | npm i [email protected] | | fixed - but not for long | npm i [email protected] |

Package versions used to trigger vulnerabilities

| severity | package@version | | -------- | --------------------- | | critical | [email protected] | | high | [email protected] | | moderate | [email protected] | | low | [email protected] |

Taken from the GitHub Advisory Database.

Please don't use this package in production.