PkgRadar

npm · registry.npmjs.org

floating-games-sdk

Install-time lifecycle script: postinstall="node install-peers.js"

Why PkgRadar flagged 1.0.7

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspostinstall added in 1.0.7 vs 1.0.6: "node install-peers.js" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.15Review52026-06-16
1.0.14Review52026-06-16
1.0.13Review52026-06-11
1.0.7High risk452026-06-10
1.0.12Review52026-06-08
1.0.11Review52026-06-04
1.0.9Review52026-05-30
1.0.10Review52026-05-30
1.0.8Review52026-05-30

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates floating-games-sdk (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]