Package evidence

@agent-pattern-labs/[email protected]

Install-time lifecycle script: postinstall="node bin/sync.mjs"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@agent-pattern-labs/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@agent-pattern-labs/[email protected]"],"fail_on":"high"}'

Publisherrazroo

Artifact bytes40,161

Previous version0.1.5

Published2026-05-24T05:22:38.612Z

SHA-2562f15730883d91b913e08c4ac606096d09e6efd4cff1620b427e67c78e7dd9f75

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node bin/sync.mjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

30Score

0.1.6Version

Status history (1 event)

new → available24d ago · risk high · score 30 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

razroo

8 members · evidence strength 70

Repeated static TTPstale

Install-time lifecycle script — postinstall="node bin/sync.mjs"

8 members · evidence strength 76

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install-time lifecycle script	package.json	postinstall="node bin/sync.mjs"	30

Manifest

Package metadata

Scripts11

build:configiso build .
helpnode bin/software-contract-forge.mjs help
planiso plan .
postinstallnode bin/sync.mjs
prepacknpm run build:config
scannode bin/software-contract-forge.mjs scan
score:explainnode bin/software-contract-forge.mjs score:explain
slugifynode bin/software-contract-forge.mjs slugify
syncnode bin/sync.mjs
todaynode bin/software-contract-forge.mjs today
validatenode scripts/check-structure.mjs

Dependencies22

@agent-pattern-labs/iso-cache^0.1.1
@agent-pattern-labs/iso-canon^0.1.1
@agent-pattern-labs/iso-capabilities^0.1.1
@agent-pattern-labs/iso-context^0.1.1
@agent-pattern-labs/iso-contract^0.1.1
@agent-pattern-labs/iso-facts^0.1.1
@agent-pattern-labs/iso-guard^0.1.1
@agent-pattern-labs/iso-index^0.1.1
@agent-pattern-labs/iso-ledger^0.1.1
@agent-pattern-labs/iso-lineage^0.1.1
@agent-pattern-labs/iso-migrate^0.1.1
@agent-pattern-labs/iso-orchestrator^0.2.1
@agent-pattern-labs/iso-postflight^0.1.1
@agent-pattern-labs/iso-preflight^0.1.1
@agent-pattern-labs/iso-prioritize^0.1.1
@agent-pattern-labs/iso-redact^0.1.1
@agent-pattern-labs/iso-score^0.1.1
@agent-pattern-labs/iso-timeline^0.1.1
@agent-pattern-labs/iso-trace^0.5.1
fast-xml-parser^5.8.0
playwright^1.58.1
yaml^2.9.0