PkgRadar

Package evidence

@firstfleet/[email protected]

Install-time lifecycle script: install="prebuild-install || node-gyp rebuild"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
8
Versions published
1
First published
Apr 2021
Publisher
brbeaird

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@firstfleet/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@firstfleet/[email protected]"],"fail_on":"review"}'
Publisherbrbeaird
Artifact bytes743,839
Previous versionnone
Published2021-04-30T16:12:17.865Z
SHA-2565e7cb42804b67004b2e34a30f7e4be31d9c30bbc80176e887d2c9773d5430e6a

Why flagged

What the scanner saw

Install-time lifecycle script: install="prebuild-install || node-gyp rebuild"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
1.0.0Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsoninstall="prebuild-install || node-gyp rebuild"5

Manifest

Package metadata

Scripts9
  • installprebuild-install || node-gyp rebuild
  • linux-testnode runtest -u -t json -t connection-pool -t pause -t concurrent -t multiple-errors -t geography -t tvp -t warnings.js -t compoundqueries.js -t querycancel.js -t txn.js -t datatypes.js -t params.js -t query.js -t querytimeout.js -t connect.js -t bulk.js -t sproc.js -t prepared.js -t userbind.js -t dates.js 2>&1
  • prebuild-allnpm run prebuild-node && npm run prebuild-node-ia32 && npm run prebuild-electron && npm run prebuild-electron-ia32
  • prebuild-electronprebuild -t 6.1.9 -t 7.2.1 -t 8.2.3 -t 9.0.5 -t 10.1.4 -t 11.3.0 -t 12.0.0 -r electron --strip -u 9d881e2b1587cb085419d0c24d207f100419c3d5
  • prebuild-electron-ia32prebuild -t 6.1.9 -t 7.2.1 -t 8.2.3 -t 9.0.5 -t 10.1.4 -t 11.3.0 -t 12.0.0 -r electron -a ia32 --strip -u 9d881e2b1587cb085419d0c24d207f100419c3d5
  • prebuild-gypnode-gyp rebuild
  • prebuild-nodeprebuild -t 10.16.0 -t 11.15.0 -t 12.18.3 -t 13.14.0 -t 14.14.0 -t 15.11.0 --strip -u 9d881e2b1587cb085419d0c24d207f100419c3d5
  • prebuild-node-ia32prebuild -t 10.16.0 -t 11.15.0 -t 12.18.3 -t 13.14.0 -t 14.14.0 -t 15.11.0 -a ia32 --strip -u 9d881e2b1587cb085419d0c24d207f100419c3d5
  • testnode runtest -l -t json -t connection-pool -t pause -t concurrent -t multiple-errors -t geography -t tvp -t warnings.js -t compoundqueries.js -t querycancel.js -t txn.js -t datatypes.js -t params.js -t query.js -t querytimeout.js -t connect.js -t bulk.js -t sproc.js -t prepared.js -t userbind.js -t dates.js 2>&1
Dependencies2
  • nan^2.14.2
  • prebuild-install^6.0.0