npm · registry.npmjs.org
@query-farm/vgi-rpc
Install Lifecycle Remote Or Exec: postinstall="cd node_modules/@query-farm/apache-arrow && node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.main='src/Arrow.node.ts';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\" && cd ../../.. && bun scripts/patch-flechette.mjs"
Why PkgRadar flagged 0.7.0
| Severity | Signal | Evidence |
|---|---|---|
| high | Install Lifecycle Remote Or Exec | postinstall="cd node_modules/@query-farm/apache-arrow && node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.main='src/Arrow.node.ts';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\" && cd ../../.. && bun scripts/patch-flechette.mjs" · package.json |
| medium | Remote Dependency Spec | dependencies.@uwdata/flechette="github:Query-farm/flechette#fix/timestamp-bigint-encode" · package.json |
| medium | New Remote Dependency Vs Previous | dependencies.@uwdata/flechette added in 0.7.0 vs 0.6.4: "github:Query-farm/flechette#fix/timestamp-bigint-encode" · package.json |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.7.0 | High risk | 59 | 2026-06-10 |
0.7.2 | Review | 14 | 2026-06-03 |
0.7.1 | Review | 14 | 2026-06-03 |
0.6.4 | Review | 10 | 2026-06-02 |
Block this in CI
pkgradar gate --ecosystem npm @query-farm/[email protected]