Package evidence
@evolvconsulting/[email protected]
Install-time lifecycle script: postinstall="node scripts/check-windows-path.cjs"
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 481
- Versions published
- 15
- First published
- May 2026
- Publisher
- jeremy-newhouse
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@evolvconsulting/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@evolvconsulting/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
New Lifecycle Script Vs Previous: postinstall added in 1.2.0 vs 1.1.11: "node scripts/check-windows-path.cjs"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 45 · status changed
Evidence
Static findings
1 static · 1 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | New Lifecycle Script Vs Previous | package.json | postinstall added in 1.2.0 vs 1.1.11: "node scripts/check-windows-path.cjs" | 40 |
Show all 2 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | New Lifecycle Script Vs Previous | package.json | postinstall added in 1.2.0 vs 1.1.11: "node scripts/check-windows-path.cjs" | 40 |
| low | Install-time lifecycle script | package.json | postinstall="node scripts/check-windows-path.cjs" | 5 |
Manifest
Package metadata
Scripts35
buildnpm run generate:identity && npm run build:hooksbuild:hooksnode scripts/build-hooks.jschangelog:rendernode scripts/changeset/cli.cjs renderchangesetnode scripts/changeset/new.cjscheck:alias-driftnode scripts/check-alias-drift.cjscheck:envnode scripts/check-env.cjscheck:identity-driftnode scripts/lint-package-identity-drift.cjscheck:integritynode scripts/check-npm-integrity.cjsci:test-scopenode scripts/ci-test-scope.cjsgenerate:identitynode scripts/generate-package-identity.cjslinteslint . --cache --cache-location node_modules/.cache/eslint/lint:changesetnode scripts/changeset/lint.cjslint:descriptionsnode scripts/lint-descriptions.cjslint:docsnode scripts/lint-docs-required.cjslint:fixeslint . --fixlint:pr-checksnode scripts/lint-pr-check-project-dir.cjslint:skill-depsnode scripts/lint-skill-deps.cjslint:test-file-countnode scripts/lint-test-file-count.cjspostinstallnode scripts/check-windows-path.cjsprepublishOnlynpm run build:hookspretestnpm run lint:skill-depspretest:coveragenpm run lint:skill-depssync:launchernode scripts/sync-runtime-launcher.cjstestnode scripts/run-tests.cjstest:affectednode scripts/run-affected-tests.cjstest:coveragec8 --check-coverage --lines 70 --reporter text --include 'evolv-coder-lite/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjstest:coverage:allnpm run test:coveragetest:coverage:unitc8 --check-coverage --lines 70 --reporter text --include 'evolv-coder-lite/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unittest:installnode scripts/run-tests.cjs --suite installtest:integrationnode scripts/run-tests.cjs --suite integration- …and 5 more.
Dependencies2
@anthropic-ai/claude-agent-sdk^0.2.84ws8.20.1
Optional dependencies1
fallow^2.70.0