PkgRadar

npm · registry.npmjs.org

@fab-orbita/cli

Install-time lifecycle script: postinstall="node scripts/postinstall.js"

Why PkgRadar flagged 2.0.2

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspostinstall added in 2.0.2 vs 2.0.0: "node scripts/postinstall.js" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.5.4Review32026-06-15
2.5.3Review32026-06-15
2.5.1Review32026-06-12
2.5.0Review32026-06-12
2.4.0Review32026-06-12
2.2.8Review52026-06-11
2.2.7Review52026-06-11
2.2.6Review52026-06-11
2.2.5Review52026-06-11
2.2.4Review52026-06-11
2.2.3Review52026-06-11
2.2.1Review52026-06-10
2.2.0Review52026-06-10
2.1.0Review52026-06-10
2.0.3Review52026-06-10
2.0.2High risk452026-06-10
2.0.0Low risk02026-05-30
1.8.3Low risk02026-05-29
1.8.1Low risk02026-05-24
1.8.2Low risk02026-05-24

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates @fab-orbita/cli (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @fab-orbita/[email protected]
Start free — 25 scans / moView full evidence