PkgRadar

npm · registry.npmjs.org

autotel-mcp-instrumentation

Native Addon Gyp Action: binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)

Why PkgRadar flagged 29.0.2

SeveritySignalEvidence
highNative Addon Gyp Actionbinding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle) · package/binding.gyp

Scanned versions

VersionVerdictScoreScanned (UTC)
29.0.2High risk102026-06-12
35.0.0Low risk02026-06-12
34.0.2Low risk02026-06-12
33.0.2Low risk02026-06-04
34.0.1Low risk02026-06-04
34.0.0Low risk02026-05-31
33.0.1Low risk02026-05-29
33.0.0Low risk02026-05-28
31.0.0Low risk02026-05-24
32.0.0Low risk02026-05-24

Block this in CI

PkgRadar gates autotel-mcp-instrumentation (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence