PkgRadar

npm · registry.npmjs.org

@getrift/rift

Install Lifecycle Remote Or Exec: postinstall="node -e \"const e=process.env;if(e.RIFT_SKIP_POSTINSTALL_MENUBAR==='1'||(e.RIFT_POSTINSTALL_MENUBAR!=='1'&&e.npm_config_global!=='true'&&e.npm_config_location!=='global'))process.exit(0);import('./dist/src/cli/postinstall-menubar.js').catch(() => {})\""

Why PkgRadar flagged 0.1.0-beta.17

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"const e=process.env;if(e.RIFT_SKIP_POSTINSTALL_MENUBAR==='1'||(e.RIFT_POSTINSTALL_MENUBAR!=='1'&&e.npm_config_global!=='true'&&e.npm_config_location!=='global'))process.exit(0);import('./dist/src/cli/postinstall-menubar.js').catch(() => {})\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
0.1.0-beta.17High risk242026-06-13
0.0.0Low risk02026-06-12
0.1.0-beta.22High risk242026-06-12
0.1.0-beta.15High risk242026-06-10
0.1.0-beta.16High risk242026-06-10
0.1.0-beta.21High risk242026-06-10
0.1.0-beta.20High risk242026-06-10
0.1.0-beta.19High risk242026-06-10
0.1.0-beta.18High risk242026-06-10

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates @getrift/rift (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @getrift/[email protected]
Start free — 25 scans / moView full evidence