PkgRadar

Package evidence

@cubicleai/[email protected]

Install-time lifecycle script: install="twine install"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
3
First published
Oct 2022
Publisher
tobytailor

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cubicleai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cubicleai/[email protected]"],"fail_on":"review"}'
Publishertobytailor
Artifact bytes136,981
Previous version0.6.0
Published2022-10-17T05:56:07.404Z
SHA-256453ccd3d50b6415248edfae2425af4a820af0788010b6c5ecae6b0e5a9ea9042

Why flagged

What the scanner saw

Install-time lifecycle script: install="twine install"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
0.6.1Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsoninstall="twine install"5

Manifest

Package metadata

Scripts28
  • buildtsc -b
  • build:nativenode scripts/build-from-source.js
  • build:native:debugnpm run configure:debug && ncmake build --debug -j 12
  • build:native:releasenpm run configure && ncmake build -j 12
  • cleanncmake clean
  • configurencmake configure
  • configure:debugncmake configure --debug
  • installtwine install
  • install-examplenode scripts/install-example.js
  • linteslint lib/*.js lib/**/*.js test/*.js test/**/*.js karma/*.js scripts/*.js
  • publish:binarytwine publish
  • testnpm run build && node --expose-gc --enable-source-maps dist/nodejs/test/test.js
  • test:browserscross-env BROWSER=chrome node scripts/karma.js && cross-env BROWSER=firefox node scripts/karma.js
  • test:cppnpm run build && node --expose-gc --enable-source-maps dist/nodejs/test/cpp-test.js
  • test:debugnpm run build && node --expose-gc --enable-source-maps --trace-exit --inspect-brk dist/nodejs/test/test.js --verbose
  • test:debug:nativenpm run build && node --expose-gc --enable-source-maps --trace-exit dist/nodejs/test/test.js --verbose --native-debug
  • test:electronelectron test/electron
  • test:gdbnpm run build && cd build/external/libwebrtc/build/Debug && gdb --args node ../../../../../dist/nodejs/test/test.js
  • test:gdb:verbosenpm run build && cd build/external/libwebrtc/build/Debug && gdb --args node ../../../../../dist/nodejs/test/test.js --verbose
  • test:verbosenpm run build && node --expose-gc --enable-source-maps --trace-exit dist/nodejs/test/test.js --verbose
  • test:vgdbnpm run build && cd build/external/libwebrtc/build/Debug && vgdb --args node ../../../../../dist/nodejs/test/test.js
  • wpt:initgit submodule update --init --recursive
  • wpt:resetrimraf ./web-platform-tests && npm run wpt:init
  • wpt:testnpm run build && node dist/nodejs/test/web-platform-tests/run-wpts.js
  • wpt:test:debugnpm run build && node --inspect-brk dist/nodejs/test/web-platform-tests/run-wpts.js
  • wpt:test:debug:nativenpm run build && node dist/nodejs/test/web-platform-tests/run-wpts.js --native-debug
  • wpt:test:gdbnpm run build && cd build/external/libwebrtc/build/Debug && gdb --args node ../../../../../dist/nodejs/test/web-platform-tests/run-wpts.js
  • wpt:updategit submodule update --recursive --remote --force && cd web-platform-tests && python wpt.py manifest --path ../lib/nodejs/test/web-platform-tests/wpt-manifest.json
Dependencies5
  • @astronautlabs/twine^1.1.2
  • bindings^1.5.0
  • nan^2.3.2
  • node-addon-api^5.0.0
  • node-cmake2.3.2
Optional dependencies1
  • domexception^1.0.1