npm · registry.npmjs.org

ultraclaude-agent

Install Lifecycle Remote Or Exec: postinstall="node -e \"import('./dist/scripts/postinstall.js').catch(()=>{})\""

Why PkgRadar flagged 0.0.22

Severity	Signal	Evidence
high	Install Lifecycle Remote Or Exec	postinstall="node -e \"import('./dist/scripts/postinstall.js').catch(()=>{})\"" · package.json

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.0.22`	Review	10	2026-06-08
`0.0.23`	Review	10	2026-06-08
`0.0.24`	Review	10	2026-06-08
`0.0.25`	Review	10	2026-06-08

Block this in CI

PkgRadar gates ultraclaude-agent (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]