PkgRadar

npm · registry.npmjs.org

@mistweaverco/kulala-fmt

Install Lifecycle Suppresses Failure: postinstall="node dist/install-backend.cjs || true"

Why PkgRadar flagged 4.0.0

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspostinstall added in 4.0.0 vs 3.2.1: "node dist/install-backend.cjs || true" · package.json
highInstall Lifecycle Suppresses Failurepostinstall="node dist/install-backend.cjs || true" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
4.0.0High risk652026-06-14
3.2.1Low risk02026-06-13
3.2.0Low risk02026-06-12
3.1.0Low risk02026-06-05
3.0.1Low risk02026-06-05
2.11.0Low risk02026-06-05
3.0.0Low risk02026-06-05

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates @mistweaverco/kulala-fmt (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @mistweaverco/[email protected]
Start free — 25 scans / moView full evidence