npm · registry.npmjs.org

polygrad

Native Addon Gyp Action: binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)

Why PkgRadar flagged 0.3.0

Severity	Signal	Evidence
high	New Lifecycle Script Vs Previous	install added in 0.3.0 vs 0.0.1: "node scripts/install-native.js" · package.json
high	Native Addon Gyp Action	binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle) · package/binding.gyp

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.3.0`	High risk	80	2026-06-10
`0.0.1`	Low risk	0	2026-05-25

Campaign attribution

Related campaigns

Block this in CI

PkgRadar gates polygrad (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]