PkgRadar

npm · registry.npmjs.org

@clicoh/orion-library

Install-time lifecycle script: preinstall="npx only-allow pnpm"

Why PkgRadar flagged 1.0.8

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspreinstall added in 1.0.8 vs 1.0.7: "npx only-allow pnpm" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.10Review12026-06-16
1.0.6Low risk02026-06-16
1.0.7Low risk02026-06-16
1.0.8High risk452026-06-16
1.0.9Review12026-06-16

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates @clicoh/orion-library (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @clicoh/[email protected]
Start free — 25 scans / moView full evidence
@clicoh/orion-library — npm security scan | PkgRadar