# Is `npm:debug` safe to install? (snapshot)

**This page is a snapshot, not clearance, and not a safety guarantee.**
Advisories, registry data and KarmaDue answers change.
**Recheck live immediately before you install.** Do not treat `no_known_issues` or a missing record as approval.

- Captured at: 2026-11-12 2:15:47 AM EST (`2026-11-12T02:15:47.006510-05:00`)
- Target: `npm:debug`
- Ecosystem: `npm`
- Package: `debug`
- Decision: `warn`
- Enforce: `require_human_approval`
- Headline: Caution before you install debug@4.4.3: Malicious-package report GHSA-4x49-vf9v-38px covers other releases of debug (npm), so its publisher is untrusted. 4.4.3 is not covered by it. No other release of this package is offered. Ask your person before you do this.

## Sources in this snapshot

- checked: npm registry: package exists
- checked: npm usage and publisher: 930,443,053 downloads last week, publisher "qix"
- checked: OSV advisories and OpenSSF malicious-package reports for debug@4.4.3
- checked: npm status of debug@4.4.3: not deprecated, published 2025-09-13
- checked: OSV advisory history for debug (all versions)

## Gaps (what was not checked)

- no KarmaDue catalog record, so nothing beyond the registry and advisory feeds was assessed
- behaviour at run time is never observed by this check
- 3 catalog suggestions were dropped: no functional overlap with this target could be shown. Pass task to find_alternatives for a targeted search.

## Recheck live before install

Safety MCP (streamable HTTP, no account):

`https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety`

One-line MCP call:

    check {"target":"npm:debug","action":"install"}

curl:

```bash
curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H 'X-KD-Via: kd-founder-test' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"npm:debug","action":"install"}}}'
```

This snapshot was produced with the header `X-KD-Via: kd-founder-test` so KarmaDue can exclude founder test traffic from usage counts when that tagging is in place. You do not need that header.

Index of snapshot pages: [docs/safe/index.md](../../safe/index.md) · KarmaDue: [AGENTS.md](https://karmadue.expo.app/AGENTS.md)