PkgRadar

npm · registry.npmjs.org

@iaforged/context-code

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Why PkgRadar flagged 2.3.7

SeveritySignalEvidence
highJs Hidden PowershellHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers. · package/dist/src/utils/sembleMcp/setup.js
highJs Hidden PowershellHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers. · package/dist/src/utils/permissions/yoloClassifier.js

Scanned versions

VersionVerdictScoreScanned (UTC)
2.3.7Review802026-06-10
2.3.6Review802026-06-10
2.3.5Review802026-06-10
2.3.3Review562026-06-02
2.3.0Review562026-05-30
2.3.1Review802026-05-30
2.1.7Review802026-05-30
2.1.8Review562026-05-30
2.1.5Review1302026-05-30
2.1.4Review912026-05-30
2.1.2Review912026-05-30
2.1.3Review912026-05-30

Block this in CI

PkgRadar gates @iaforged/context-code (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @iaforged/[email protected]
Start free — 25 scans / moView full evidence