PkgRadar

npm · registry.npmjs.org

vfx-web-sdk

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""

Why PkgRadar flagged 2.0.12

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.0.12High risk242026-06-12
2.0.13High risk242026-06-12
2.0.14High risk242026-06-12
3.0.0High risk242026-06-12

Block this in CI

PkgRadar gates vfx-web-sdk (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]