PkgRadar

npm · registry.npmjs.org

orchestray

Install Lifecycle Remote Or Exec: postinstall="node -e \"try { require('better-sqlite3') } catch (e) { console.warn('better-sqlite3 not available; FTS5 will be unavailable. Ensure build tools are present or use Node 22.5+'); }\""

Why PkgRadar flagged 2.3.7

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"try { require('better-sqlite3') } catch (e) { console.warn('better-sqlite3 not available; FTS5 will be unavailable. Ensure build tools are present or use Node 22.5+'); }\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.3.11Low risk02026-06-16
2.3.10Low risk02026-06-10
2.3.9Low risk02026-06-10
2.3.8Low risk02026-06-10
2.3.7High risk352026-06-10
2.3.4High risk352026-06-10
2.3.5Review52026-05-29
2.3.6Review52026-05-29

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates orchestray (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence
orchestray — npm security scan | PkgRadar