PkgRadar

Package evidence

@askexenow/[email protected]

Install Lifecycle Suppresses Failure: postinstall="node dist/bin/install.js --commands-only 2>/dev/null || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
8,124Niche · −30% score
Versions published
362
First published
Apr 2026
Publisher
askexenow

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@askexenow/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@askexenow/[email protected]"],"fail_on":"high"}'
Publisheraskexenow
Artifact bytes6,109,581
Previous version0.9.273
Published2026-06-11T15:11:34.866Z
SHA-256c8bbe47aaf862c5c9bdf1c99a74046327800d8a6e9f54846e472f9805a1cf461

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="node dist/bin/install.js --commands-only 2>/dev/null || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
106Score
0.9.274Version
Status history (1 event)
  1. new → available · risk high · score 106 · status changed

Evidence

Static findings

50 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node dist/bin/install.js --commands-only 2>/dev/null || true"20
mediumRemote Payloadpackage/dist/chunk-6HTXA4IM.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-6L5DS7XO.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-JEOFG274.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-L4WRH3DL.jsmatched "api.telegram.org/bot"12
mediumRemote Payloadpackage/dist/chunk-RQI5TG5F.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-X33TSJNO.jsmatched "curl "12
mediumRemote Payloadpackage/dist/bin/deferred-daemon-restart.jsmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/backup.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/setup.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/status.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/uptime-check.shmatched "curl "12
Show all 50 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node dist/bin/install.js --commands-only 2>/dev/null || true"20
mediumRemote Payloadpackage/dist/chunk-6HTXA4IM.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-6L5DS7XO.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-JEOFG274.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-L4WRH3DL.jsmatched "api.telegram.org/bot"12
mediumRemote Payloadpackage/dist/chunk-RQI5TG5F.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-X33TSJNO.jsmatched "curl "12
mediumRemote Payloadpackage/dist/bin/deferred-daemon-restart.jsmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/backup.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/setup.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/status.shmatched "curl "12
mediumRemote Payloadpackage/deploy/compose/uptime-check.shmatched "curl "12
lowCredential file accesspackage/dist/chunk-3IM3JNQV.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-5TANMPI4.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-DBJCWK6T.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-F7FZ24KM.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-FBRQGHSU.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-FS7G6NJD.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-JJ4VDZ5E.jsmatched ".config/gcloud"5
lowMessenger Bot Endpointpackage/dist/chunk-L4WRH3DL.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowCredential file accesspackage/dist/chunk-PD2LUPHD.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-UQ27GW5L.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-VKCUSNJW.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-VXODHQXB.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-XNRJ5JHU.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-XSRBNOLY.jsmatched ".config/gcloud"5
lowCredential file accesspackage/dist/chunk-Y25OJWOQ.jsmatched "aws_access_key"5
lowCredential file accesspackage/dist/chunk-YNJPRQ6J.jsmatched ".config/gcloud"5
lowCredential file accesspackage/deploy/compose/backup.shmatched "AWS_ACCESS_KEY"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node dist/bin/install.js --commands-only 2>/dev/null || true"5
lowObfuscation Densitypackage/dist/chunk-6WKV4F6L.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/chunk-7HUGVJHW.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/chunk-7OEUOJL5.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/chunk-PNWAZ4EA.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/chunk-YYO5RQRT.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-6FPQHBW6.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-6JHEINOM.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-7XX4OUXD.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-BQVOD3YE.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-H45JY44F.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-HXOWRGJT.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-JS7OSDJP.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-K3HQLUYO.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-MAEQGTB7.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-N3XYSEXP.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-Q3ZNYT6L.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-Q47RPB45.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-RIRPIFK6.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/exe-key-WR6QEHYO.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/bin/exe-settings.jshigh encoded/escaped-token density0

Manifest

Package metadata

Scripts12
  • benchmark:longmemevalnpx tsx tests/benchmarks/longmemeval.ts
  • buildtsup && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && node dist/bin/generate-hook-manifest.js 2>/dev/null || true
  • deploynode dist/bin/pre-build-guard.js 2>/dev/null; npm run build && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'
  • guard:esm-requirenode scripts/check-no-runtime-require.mjs
  • linteslint src/ --max-warnings 53
  • postinstallnode dist/bin/install.js --commands-only 2>/dev/null || true
  • prepublishOnlynpm run typecheck && npm run build && npm run guard:esm-require && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js
  • testvitest run
  • test:publishnpx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/installer/setup-wizard.test.ts' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' && echo '::warning::gateway-client suite quarantined in CI — passes via SSH on the same box, fails deterministically in the Actions job env. Tracked bug: see .exe-os bug-reports 2026-06-10 gateway-client-ws-tests. Runs in local dev + pre-publish.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts
  • test:stack-simnode scripts/stack-sim.mjs
  • test:watchvitest
  • typechecktsc --noEmit
Dependencies26
  • @anthropic-ai/sdk^0.95.2
  • @aws-sdk/client-s3^3.1052.0
  • @aws-sdk/s3-request-presigner^3.1052.0
  • @libsql/client^0.14.0
  • @modelcontextprotocol/sdk^1.29.0
  • @opentelemetry/api^1.9.1
  • @opentelemetry/sdk-node^0.218.0
  • @opentelemetry/sdk-trace-base^2.7.0
  • @slack/bolt^4.7.0
  • @slack/web-api^7.15.1
  • @whiskeysockets/baileys^7.0.0-rc10
  • bip39^3.1.0
  • discord.js^14.26.3
  • grammy^1.42.0
  • ink^6.8.0
  • ink-text-input^6.0.0
  • jose^6.2.2
  • node-llama-cpp^3.18.0
  • nodemailer^8.0.5
  • openai^6.33.0
  • pg^8.20.0
  • react^19.2.4
  • typescript^5.9.3
  • ws^8.21.0
  • yjs^13.6.30
  • zod^4.3.6
Optional dependencies1
  • keytar^7.9.0