npm · registry.npmjs.org

@addai/entity-runtime

Install-time lifecycle script

Early detection

PkgRadar flagged this 21.9 days before public disclosure

Detected 2026-07-15 · disclosed as MAL-2026-13410 on 2026-08-06

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.2.46`	High risk	5	2026-08-22
`0.2.45`	High risk	5	2026-08-20
`0.2.58`	Review	3	2026-07-29
`0.2.56`	Review	3	2026-07-29
`0.2.55`	Review	3	2026-07-28
`0.2.53`	Review	3	2026-07-28
`0.2.52`	Review	5	2026-07-27
`0.2.51`	Review	5	2026-07-25
`0.2.50`	Review	5	2026-07-25
`0.2.49`	Review	2	2026-07-22
`0.2.48`	Review	1	2026-07-21
`0.2.47`	Low risk	0	2026-07-21
`0.2.44`	Low risk	0	2026-07-15
`0.2.43`	Low risk	0	2026-07-15
`0.2.42`	Low risk	0	2026-07-15
`0.2.41`	Low risk

Block this in CI

PkgRadar gates @addai/entity-runtime (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @addai/[email protected]

Prefer zero config? Install the GitHub App and it gates every pull request automatically — no pipeline edits, no API key.