Package evidence

@agent-pattern-labs/[email protected]

Install-time lifecycle script: postinstall="node bin/sync.mjs"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@agent-pattern-labs/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@agent-pattern-labs/[email protected]"],"fail_on":"high"}'

Publisherrazroo

Artifact bytes53,905

Previous version0.1.5

Published2026-05-24T20:23:50.845Z

SHA-2569db93002674d31373ef0e9d63ccb709317388c88c8f7158c5326968a1bb4096c

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node bin/sync.mjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

33Score

0.1.6Version

Status history (1 event)

new → available24d ago · risk high · score 33 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

razroo

8 members · evidence strength 70

Repeated static TTPstale

Install-time lifecycle script — postinstall="node bin/sync.mjs"

8 members · evidence strength 76

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install-time lifecycle script	package.json	postinstall="node bin/sync.mjs"	30

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install-time lifecycle script	package.json	postinstall="node bin/sync.mjs"	30
low	Obfuscation	package/lib/leadharness-crawler.mjs	matched "fromCharCode"	3

Manifest

Package metadata

Scripts85

batchbatch/batch-runner.sh
build:configiso-route build models.yaml --out . && iso-harness build
cache:getnode bin/lead-harness.mjs cache:get
cache:hasnode bin/lead-harness.mjs cache:has
cache:keynode bin/lead-harness.mjs cache:key
cache:listnode bin/lead-harness.mjs cache:list
cache:prunenode bin/lead-harness.mjs cache:prune
cache:putnode bin/lead-harness.mjs cache:put
cache:statusnode bin/lead-harness.mjs cache:status
cache:verifynode bin/lead-harness.mjs cache:verify
canon:comparenode bin/lead-harness.mjs canon:compare
canon:explainnode bin/lead-harness.mjs canon:explain
canon:keynode bin/lead-harness.mjs canon:key
canon:normalizenode bin/lead-harness.mjs canon:normalize
capabilities:checknode bin/lead-harness.mjs capabilities:check
capabilities:explainnode bin/lead-harness.mjs capabilities:explain
capabilities:listnode bin/lead-harness.mjs capabilities:list
context:checknode bin/lead-harness.mjs context:check
context:explainnode bin/lead-harness.mjs context:explain
context:listnode bin/lead-harness.mjs context:list
context:plannode bin/lead-harness.mjs context:plan
context:rendernode bin/lead-harness.mjs context:render
facts:buildnode bin/lead-harness.mjs facts:build
facts:hasnode bin/lead-harness.mjs facts:has
facts:querynode bin/lead-harness.mjs facts:query
facts:statusnode bin/lead-harness.mjs facts:status
facts:verifynode bin/lead-harness.mjs facts:verify
guard:auditnode bin/lead-harness.mjs guard:audit
guard:explainnode bin/lead-harness.mjs guard:explain
index:buildnode bin/lead-harness.mjs index:build
…and 55 more.

Dependencies20

@agent-pattern-labs/iso-cache^0.1.1
@agent-pattern-labs/iso-canon^0.1.1
@agent-pattern-labs/iso-capabilities^0.1.1
@agent-pattern-labs/iso-context^0.1.1
@agent-pattern-labs/iso-contract^0.1.1
@agent-pattern-labs/iso-facts^0.1.1
@agent-pattern-labs/iso-guard^0.1.1
@agent-pattern-labs/iso-index^0.1.1
@agent-pattern-labs/iso-ledger^0.1.1
@agent-pattern-labs/iso-lineage^0.1.1
@agent-pattern-labs/iso-migrate^0.1.1
@agent-pattern-labs/iso-orchestrator^0.2.1
@agent-pattern-labs/iso-postflight^0.1.1
@agent-pattern-labs/iso-preflight^0.1.1
@agent-pattern-labs/iso-prioritize^0.1.1
@agent-pattern-labs/iso-redact^0.1.1
@agent-pattern-labs/iso-score^0.1.1
@agent-pattern-labs/iso-timeline^0.1.1
@agent-pattern-labs/iso-trace^0.5.1
playwright^1.58.1