PkgRadar

npm · registry.npmjs.org

@hasna/invoices

Tls Verification Disabled, New Account With Lifecycle Hook, Install-time lifecycle script +1 more

Why PkgRadar flagged 0.1.0

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspackage.json
mediumTls Verification Disabledpackage/dist/cli/index.js
mediumTls Verification Disabledpackage/dist/index.js
mediumTls Verification Disabledpackage/dist/mcp/index.js
mediumNew Account With Lifecycle Hookpackage.json

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

VersionVerdictScoreScanned (UTC)
0.1.4Low risk02026-06-21
0.1.3Low risk02026-06-21
0.0.1Low risk02026-06-20
0.1.0High risk812026-06-20
0.1.1Review482026-06-20
0.1.2Low risk02026-06-20

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates @hasna/invoices (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @hasna/[email protected]
Start free — 25 scans / moView full evidence