npm · registry.npmjs.org
vfx-web-sdk
Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""
Why PkgRadar flagged 2.0.12
| Severity | Signal | Evidence |
|---|---|---|
| high | Install Lifecycle Remote Or Exec | postinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\"" · package.json |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.0.12 | High risk | 24 | 2026-06-12 |
2.0.13 | High risk | 24 | 2026-06-12 |
2.0.14 | High risk | 24 | 2026-06-12 |
3.0.0 | High risk | 24 | 2026-06-12 |
Block this in CI
pkgradar gate --ecosystem npm [email protected]