PkgRadar

npm · registry.npmjs.org

@alauda/custom-webpack

Install Lifecycle Remote Or Exec: postinstall="node -e \"require('fs').existsSync('.git') && require('child_process').execSync('patch-package && yarn schema && simple-git-hooks', {stdio:'inherit', shell:true})\""

Why PkgRadar flagged 5.2.10

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"require('fs').existsSync('.git') && require('child_process').execSync('patch-package && yarn schema && simple-git-hooks', {stdio:'inherit', shell:true})\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
5.3.2Low risk02026-06-04
5.3.1-preview.135.e8104e2Low risk02026-06-04
5.3.1Low risk02026-06-03
5.3.0Low risk02026-06-03
5.2.10-preview.132.4acdd54Low risk02026-06-03
5.2.10-preview.132.803487eLow risk02026-06-03
5.3.0-beta.0Low risk02026-06-03
5.2.10Review102026-06-03
5.3.0-betaLow risk02026-06-03

Block this in CI

PkgRadar gates @alauda/custom-webpack (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @alauda/[email protected]
Start free — 25 scans / moView full evidence