Package evidence

@hoshinorin/[email protected]

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 207
Versions published: 4
First published: May 2026
Publisher: hoshinorin

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@hoshinorin/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@hoshinorin/[email protected]"],"fail_on":"review"}'

Publisherhoshinorin

Artifact bytes4,038,190

Previous version0.2.0

Published2026-06-08T00:16:35.490Z

SHA-2561058bad905d44e516b24a99e55243a3036fe6a9358797f1581e70bcb6b0b09f6

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

5d agoLast checked

reviewRisk

84Score

0.3.0Version

Status history (1 event)

new → available5d ago · risk review · score 84 · status changed

Evidence

Static findings

7 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Hidden Powershell	package/dist/core/rin-web-search/service.js	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
high	Js Hidden Powershell	package/extensions/rin-web-search/service.ts	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
high	Js Hidden Powershell	package/src/core/rin-web-search/service.ts	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
medium	Remote Payload	package/install.sh	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/update.sh	matched "raw.githubusercontent.com"	12

Show all 7 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Js Hidden Powershell	package/dist/core/rin-web-search/service.js	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
high	Js Hidden Powershell	package/extensions/rin-web-search/service.ts	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
high	Js Hidden Powershell	package/src/core/rin-web-search/service.ts	Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm \| iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.	45
medium	Remote Payload	package/install.sh	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/update.sh	matched "raw.githubusercontent.com"	12
low	Messenger Bot Endpoint	package/dist/core/chat-runtime/index.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Messenger Bot Endpoint	package/src/core/chat-runtime/index.ts	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5

Manifest

Package metadata

Scripts21

buildnpm run build:core && chmod +x dist/app/rin/main.js dist/app/rin-daemon/daemon.js dist/app/rin-daemon/worker.js dist/app/rin-tui/main.js dist/app/rin-gui/main.js dist/app/rin-desktop-host/main.js dist/app/rin-install/main.js
build:corerm -rf dist && tsc -p tsconfig.json --pretty false
formattsx scripts/run-format-check.ts --write
format:checktsx scripts/run-format-check.ts --check
lintNODE_OPTIONS=--import=tsx eslint . --ext .ts --max-warnings 0
lint:fixNODE_OPTIONS=--import=tsx eslint . --ext .ts --fix
preparetsx scripts/install-git-hooks.ts
release:bootstraptsx scripts/release/export-bootstrap-branch.ts
release:changelogtsx scripts/release/verify-changelog.ts
release:manifesttsx scripts/release/update-release-manifest.ts
sync:pi-docstsx scripts/sync-upstreams.ts pi
sync:prompt-engineertsx scripts/sync-upstreams.ts prompt-engineer
sync:skill-creatortsx scripts/sync-upstreams.ts skill-creator
sync:upstreamstsx scripts/sync-upstreams.ts
testnpm run test:unit && npm run test:e2e
test:e2enpm run build && node --import tsx --test --test-concurrency=2 $(find tests/e2e -name '*.test.ts' -print | sort)
test:interactivenpm run build && node --import tsx --test --test-concurrency=2 $(find tests/interactive -name '*.test.ts' -print | sort)
test:manual:install-tuinpm run build && node --import tsx tests/interactive/install-to-tui-manual.ts
test:manual:install-tui:scriptednpm run build && node --import tsx tests/interactive/install-to-tui-manual.ts --scripted
test:releasenode --import tsx --test --test-concurrency=4 tests/unit/installer-modules.test.ts tests/unit/rin-cli.test.ts tests/unit/rpc-and-shared.test.ts tests/e2e/bootstrap-entrypoint.test.ts tests/e2e/install-to-tui-user-flow.test.ts tests/unit/release.test.ts tests/e2e/release-scripts.test.ts
test:unitnpm run build && node --import tsx --test --test-concurrency=4 $(find tests/unit -name '*.test.ts' -print | sort)

Dependencies36

@clack/prompts^0.10.1
@earendil-works/pi-agent-core^0.78.1
@earendil-works/pi-ai^0.78.1
@earendil-works/pi-coding-agent^0.78.1
@earendil-works/pi-tui^0.78.1
@larksuiteoapi/node-sdk^1.60.0
@mozilla/readability^0.6.0
@silvia-odwyer/photon-node^0.3.4
@slack/socket-mode^2.0.6
@slack/web-api^7.15.1
@types/jsdom^28.0.1
@types/turndown^5.0.6
better-sqlite3^12.8.0
cac^6.7.14
chalk^5.6.2
cli-highlight^2.1.11
diff^8.0.4
discord.js^14.26.3
electron^41.3.0
extract-zip^2.0.1
file-type^21.3.4
glob^13.0.6
hosted-git-info^9.0.2
ignore^7.0.5
jsdom^29.1.1
marked^15.0.12
minimatch^10.2.4
pretty-ms^9.3.0
proper-lockfile^4.1.2
qq-guild-bot^2.9.5
…and 6 more.