PkgRadar

npm · registry.npmjs.org

@eeacms/volto-searchlib

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs=require('fs'); const path=require('path'); let file; try { file=path.join(path.dirname(require.resolve('@eeacms/volto-eea-chatbot/package.json')), 'src/ChatBlock/chat/AIMessage.tsx'); } catch (error) { process.exit(0); } const from=\\\"import visit from 'unist-util-visit';\\\"; const to=\\\"import { visit } from 'unist-util-visit';\\\"; const source=fs.readFileSync(file, 'utf8'); if (source.includes(from) && !source.includes(to)) { fs.writeFileSync(file, source.replace(from, to)); }\""

Why PkgRadar flagged 4.1.1

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"const fs=require('fs'); const path=require('path'); let file; try { file=path.join(path.dirname(require.resolve('@eeacms/volto-eea-chatbot/package.json')), 'src/ChatBlock/chat/AIMessage.tsx'); } catch (error) { process.exit(0); } const from=\\\"import visit from 'unist-util-visit';\\\"; const to=\\\"import { visit } from 'unist-util-visit';\\\"; const source=fs.readFileSync(file, 'utf8'); if (source.includes(from) && !source.includes(to)) { fs.writeFileSync(file, source.replace(from, to)); }\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
4.1.1High risk172026-06-10
4.0.3High risk172026-06-10
4.1.0High risk172026-06-10

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates @eeacms/volto-searchlib (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @eeacms/[email protected]