Package evidence

@harmoniclabs/[email protected]

Install-time lifecycle script: postinstall="tsx ./build/postinstall"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 26
Versions published: 9
First published: Jul 2025
Publisher: harmonicpool

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@harmoniclabs/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@harmoniclabs/[email protected]"],"fail_on":"review"}'

Publisherharmonicpool

Artifact bytes28,322,452

Previous version0.1.1

Published2026-03-15T00:40:44.877Z

SHA-256a4380e1a76b0cbd870b1714a9507afa2ee865bd6ddb515eca806568c3955ffa1

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="tsx ./build/postinstall"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

13d agoLast checked

reviewRisk

5Score

0.1.2Version

Status history (1 event)

new → available13d ago · risk review · score 5 · status changed

Evidence

Static findings

13 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 13 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="tsx ./build/postinstall"	5
low	Large Javascript Payload	package/out/monaco-editor/dev/vs/editor/editor.main.js	9513456 bytes	0
low	Large Javascript Payload	package/out/monaco-editor/min/vs/editor/editor.main.js	3765869 bytes	0
low	Obfuscation Density	package/out/languages/bundled/amd-min/vs/basic-languages/freemarker2/freemarker2.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/out/monaco-editor/min/vs/basic-languages/freemarker2/freemarker2.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/out/languages/amd-tsc/language/typescript/lib/lib.js	2408112 bytes	0
low	Large Javascript Payload	package/out/languages/bundled/esm/vs/language/typescript/ts.worker.js	11190726 bytes	0
low	Large Javascript Payload	package/out/monaco-editor/esm/vs/language/typescript/ts.worker.js	11190709 bytes	0
low	Large Javascript Payload	package/out/languages/bundled/amd-dev/vs/language/typescript/tsWorker.js	11597508 bytes	0
low	Large Javascript Payload	package/out/languages/bundled/amd-min/vs/language/typescript/tsWorker.js	5749264 bytes	0
low	Large Javascript Payload	package/out/monaco-editor/dev/vs/language/typescript/tsWorker.js	11597508 bytes	0
low	Large Javascript Payload	package/out/monaco-editor/min/vs/language/typescript/tsWorker.js	5749264 bytes	0
low	Large Javascript Payload	package/out/languages/amd-tsc/language/typescript/lib/typescriptServices.js	10983482 bytes	0

Manifest

Package metadata

Scripts21

buildtsx ./build/build-languages && tsx ./build/build-monaco-editor
build-monaco-editornpm run build
deps-all-installtsx ./build/npm/installAll
deps-all-removetsx ./build/npm/removeAll
import-typescripttsx ./build/importTypescript
package-for-smoketest-esbuildtsx ./test/smoke/package-esbuild
package-for-smoketest-vitetsx ./test/smoke/package-vite
package-for-smoketest-webpacktsx ./test/smoke/package-webpack
package-for-smoketest-webpack-cross-origintsx ./test/smoke/package-webpack --cross-origin
playwright-installnode ./node_modules/playwright/install.js
playwright-install-depsplaywright install-deps
postinstalltsx ./build/postinstall
prettierprettier --write .
prettier-checkprettier --check .
pretty-quickpretty-quick --staged
simpleservertsx ./build/simpleserver
smoketestnode ./test/smoke/runner.js
smoketest-debugnode ./test/smoke/runner.js --debug-tests
testmocha test/unit/all.js && tsx ./build/check-samples
update-actionspin-github-action ./.github/workflows/website.yml
watchtsc -w -p ./src

Dependencies2

tsx^4.20.3
typescript5.4.5