PkgRadar

npm · registry.npmjs.org

d3panels

Install Lifecycle Remote Or Exec: postinstall="node -e \"try { require('fs').symlinkSync(require('path').resolve('node_modules/@bower_components'), 'bower_components', 'junction') } catch (e) { }\""

Why PkgRadar flagged 1.9.5

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"try { require('fs').symlinkSync(require('path').resolve('node_modules/@bower_components'), 'bower_components', 'junction') } catch (e) { }\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.9.5High risk172026-06-10
1.9.4High risk172026-06-10
1.9.3High risk172026-06-10
1.9.2High risk172026-06-10
1.9.1High risk172026-06-10
1.9.0High risk172026-06-10
1.8.8High risk172026-06-10
1.8.9High risk172026-06-10

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates d3panels (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence