Package evidence
@grifhinz/[email protected]
Install-time lifecycle script: postinstall="npm run compile"
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 9
- Versions published
- 6
- First published
- Apr 2026
- Publisher
- grifhinz
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@grifhinz/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@grifhinz/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Install-time lifecycle script: postinstall="npm run compile"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 5 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 1 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Install-time lifecycle script | package.json | postinstall="npm run compile" | 5 |
Manifest
Package metadata
Scripts31
audit:cinode scripts/check-npm-audit.mjsaudit:logicsnode scripts/run-python.mjs -m logics_manager audit && node scripts/run-python.mjs -m logics_manager lintbundle:extensionnode scripts/build/package-extension.mjsci:checknode scripts/ci-check.mjsci:fastnpm run compile && npm run lint && npm run test:coverage && npm run test:smoke && npm run lint:logics && npm run package:cicompiletsc -p ./ && npm run bundle:extensiondebug:webviewnode debug/webview/server.mjsdevnpm run compile && code --extensionDevelopmentPath=.install:vsixnpm run package && node scripts/build/install-vsix.mjslintnpm run lint:ts && npm run lint:eslint:eseslint src/**/*.tslint:logicsnode scripts/run-python.mjs -m logics_manager lintlint:tstsc -p ./ --noEmitlogics:finish:tasknode scripts/run-python.mjs -m logics_manager flow finish taskpackagenpm run compile && node scripts/build/package-release.mjspackage:cinode scripts/build/package-ci.mjspostinstallnpm run compilepublish:npmnode scripts/release/publish-npm.mjsrelease:changelog:resolvenode scripts/release/resolve-release-changelog.mjs --validate-currentrelease:changelog:validatenode scripts/release/resolve-release-changelog.mjs --validate-current --require-curatedtestvitest runtest:coveragenpm run test:coverage:src && npm run test:coverage:mediatest:coverage:medianode scripts/run-plugin-coverage.mjs mediatest:coverage:srcnode scripts/run-plugin-coverage.mjs srctest:lifecyclenode tests/run_plugin_lifecycle_checks.mjstest:npm-clinode scripts/npm/logics-manager.mjs --helptest:smokenode tests/run_extension_smoke_checks.mjstest:watchvitestwatchnpm run watch:bundlewatch:bundlenode scripts/build/package-extension.mjs --watch- …and 1 more.