npm · registry.npmjs.org
claude-friends
Install Lifecycle Remote Or Exec: postinstall="node -e \"const{cpSync,mkdirSync,unlinkSync}=require('fs'),{join}=require('path'),d=join(require('os').homedir(),'.claude','commands');mkdirSync(d,{recursive:true});try{unlinkSync(join(d,'friend.md'))}catch{};try{unlinkSync(join(d,'friends.md'))}catch{};try{cpSync(join(__dirname,'commands'),d,{recursive:true})}catch{}\""
Why PkgRadar flagged 0.4.18
| Severity | Signal | Evidence |
|---|---|---|
| high | Install Lifecycle Remote Or Exec | postinstall="node -e \"const{cpSync,mkdirSync,unlinkSync}=require('fs'),{join}=require('path'),d=join(require('os').homedir(),'.claude','commands');mkdirSync(d,{recursive:true});try{unlinkSync(join(d,'friend.md'))}catch{};try{unlinkSync(join(d,'friends.md'))}catch{};try{cpSync(join(__dirname,'commands'),d,{recursive:true})}catch{}\"" · package.json |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.4.18 | High risk | 35 | 2026-06-05 |
0.4.19 | High risk | 35 | 2026-06-05 |
Block this in CI
pkgradar gate --ecosystem npm [email protected]