PkgRadar

npm · registry.npmjs.org

agent-threat-rules

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Why PkgRadar flagged 3.4.0

SeveritySignalEvidence
highJs Hidden PowershellHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers. · package/dist/eval/corpus.js
highJs Hidden PowershellHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers. · package/dist/eval/rule-corpus.js
highKnown Indicator Filenamepackage/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml · package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml

Scanned versions

VersionVerdictScoreScanned (UTC)
3.4.0High risk1952026-06-15
3.0.5High risk2662026-06-13
3.3.1High risk1922026-06-11
3.3.0High risk1922026-06-11
3.2.0High risk1892026-06-10
3.1.1High risk1892026-06-10
3.1.0High risk1892026-06-10
2.2.1Review1322026-05-29

Block this in CI

PkgRadar gates agent-threat-rules (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]