PkgRadar

npm · registry.npmjs.org

@elizaos/plugin-quick-starter

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs=require('fs');const path=require('path');const zodPath=path.join('node_modules','zod');if(fs.existsSync(zodPath)){fs.writeFileSync(path.join(zodPath,'v3.js'),'module.exports=require(\\\"./lib/index.js\\\");');fs.writeFileSync(path.join(zodPath,'v3.d.ts'),'export * from \\\"./lib/index\\\";');}\" || true"

Why PkgRadar flagged 1.7.2

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"const fs=require('fs');const path=require('path');const zodPath=path.join('node_modules','zod');if(fs.existsSync(zodPath)){fs.writeFileSync(path.join(zodPath,'v3.js'),'module.exports=require(\\\"./lib/index.js\\\");');fs.writeFileSync(path.join(zodPath,'v3.d.ts'),'export * from \\\"./lib/index\\\";');}\" || true" · package.json
highInstall Lifecycle Suppresses Failurepostinstall="node -e \"const fs=require('fs');const path=require('path');const zodPath=path.join('node_modules','zod');if(fs.existsSync(zodPath)){fs.writeFileSync(path.join(zodPath,'v3.js'),'module.exports=require(\\\"./lib/index.js\\\");');fs.writeFileSync(path.join(zodPath,'v3.d.ts'),'export * from \\\"./lib/index\\\";');}\" || true" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.7.2High risk382026-06-16
1.7.3-alpha.1High risk382026-06-16
1.7.3-alpha.2High risk382026-06-16
1.7.3-alpha.3High risk382026-06-16
1.7.3-alpha.4High risk382026-06-16

Campaign attribution

Part of the Clob dropper campaign.

Related campaigns

Block this in CI

PkgRadar gates @elizaos/plugin-quick-starter (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @elizaos/[email protected]