PkgRadar

npm · registry.npmjs.org

@mohantn/gate-keeper

Install Lifecycle Remote Or Exec: postinstall="node -e \"try{require('./scripts/postinstall.js')}catch(e){}\""

Why PkgRadar flagged 2.3.2

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"try{require('./scripts/postinstall.js')}catch(e){}\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.3.2High risk352026-06-10
2.3.0High risk352026-06-10
2.3.1High risk352026-06-10
2.2.6High risk352026-06-10
2.2.5High risk352026-06-10
2.3.8Review32026-06-01
2.3.6Review52026-05-30
2.3.7Review52026-05-30
2.3.5Review32026-05-30
2.3.4Review52026-05-30
2.3.3Review52026-05-30

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates @mohantn/gate-keeper (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @mohantn/[email protected]
Start free — 25 scans / moView full evidence