npm · registry.npmjs.org
@oaklandzoo/ostup
Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.
Why PkgRadar flagged 0.29.0
| Severity | Signal | Evidence |
|---|---|---|
| high | Js Hidden Powershell | Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers. · package/src/bootstrap.mjs |
| medium | Remote Payload | matched "curl " · package/src/bootstrap.mjs |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.29.0 | Review | 72 | 2026-06-04 |
0.28.0 | Review | 72 | 2026-06-04 |
0.27.0 | Review | 50 | 2026-06-04 |
0.26.0 | Review | 50 | 2026-06-04 |
0.25.2 | Review | 50 | 2026-06-02 |
0.25.1 | Review | 50 | 2026-06-01 |
0.25.0 | Review | 72 | 2026-06-01 |
0.24.0 | Review | 72 | 2026-06-01 |
0.23.0 | Review | 50 | 2026-06-01 |
0.20.0 | Review | 50 | 2026-05-31 |
0.18.0 | Review | 50 | 2026-05-30 |
0.17.1 | Review | 50 | 2026-05-30 |
0.16.0 | Review | 50 | 2026-05-29 |
0.15.0 | Review | 50 | 2026-05-28 |
0.13.0 | Review | 34 | 2026-05-28 |
0.14.0 | Review | 27 | 2026-05-28 |
Block this in CI
pkgradar gate --ecosystem npm @oaklandzoo/[email protected]