PkgRadar

npm · registry.npmjs.org

lit-search-cite

New Account With Lifecycle Hook: package first published 0 day(s) ago, 10 total version(s), has lifecycle hook

Why PkgRadar flagged 1.0.8

SeveritySignalEvidence
highNew Lifecycle Script Vs Previouspostinstall added in 1.0.8 vs 1.0.7: "node cli.js" · package.json
mediumNew Account With Lifecycle Hookpackage first published 0 day(s) ago, 10 total version(s), has lifecycle hook · package.json
mediumSuspicious Publish Context{"package_age_days":0,"publisher":"luffysolution","burst_same_day":1,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.23Review202026-06-15
1.0.22Review202026-06-15
1.0.21Review202026-06-15
1.0.20Review202026-06-15
1.0.19Review202026-06-15
1.0.18Review202026-06-15
1.0.17Review202026-06-15
1.0.16Review202026-06-15
1.0.15Review202026-06-15
1.0.14Review202026-06-15
1.0.13Review202026-06-15
1.0.12Review202026-06-15
1.0.11Review152026-06-15
1.0.10Review152026-06-15
1.0.8High risk552026-06-15
1.0.9Review152026-06-15
1.0.7Review102026-06-15
1.0.6Review102026-06-15
1.0.4Review102026-06-15
1.0.5Review102026-06-15
1.0.3Review102026-06-15
1.0.2Review102026-06-15
1.0.0Review102026-06-15
1.0.1Review102026-06-15

Campaign attribution

Part of the asteroiddao npm campaign campaign.

Block this in CI

PkgRadar gates lit-search-cite (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence