Package evidence

@kimdu/[email protected]

New Account With Lifecycle Hook: package first published 14 day(s) ago, 1 total version(s), has lifecycle hook

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: May 2026
Publisher: kimdu

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kimdu/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kimdu/[email protected]"],"fail_on":"high"}'

Publisherkimdu

Artifact bytes6,288,538

Previous versionnone

Published2026-05-27T12:48:31.225Z

SHA-256202c8a3715055b04e63ad7a27fe3c1dd2e8d3bca6cd796d69956048c4fce866f

Why flagged

What the scanner saw

New Account With Lifecycle Hook: package first published 14 day(s) ago, 1 total version(s), has lifecycle hook

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

3d agoLast checked

highRisk

25Score

0.1.0Version

Status history (2 events)

available → available13d ago · risk high · score 25 · status available -> available, risk high -> high, score 45 -> 25
new → available16d ago · risk high · score 45 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	New Account With Lifecycle Hook	package.json	package first published 14 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="electron-rebuild 2>/dev/null \|\| npm rebuild better-sqlite3 2>/dev/null \|\| true"	20

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	New Account With Lifecycle Hook	package.json	package first published 14 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="electron-rebuild 2>/dev/null \|\| npm rebuild better-sqlite3 2>/dev/null \|\| true"	20
low	Install-time lifecycle script	package.json	postinstall="electron-rebuild 2>/dev/null \|\| npm rebuild better-sqlite3 2>/dev/null \|\| true"	5
low	Large Javascript Payload	package/dist/cli/index.cjs	8064015 bytes	0

Manifest

Package metadata

Scripts19

buildelectron-vite build
build:allnpm run build:web && npm run build:cli && cp -r web dist/
build:clinpx esbuild src/cli/index.ts --bundle --platform=node --format=cjs --outfile=dist/cli/index.cjs --external:better-sqlite3 --external:electron --external:electron-log --external:electron-vite --sourcemap
build:macnpm run build && electron-builder --mac
build:mac-arm64npm run build && electron-builder --mac --arm64
build:mac-x64npm run build && electron-builder --mac --x64
build:webvite build --config vite.web.config.ts
build:winnpm run build && electron-builder --win
build:win-x64npm run build && electron-builder --win --x64
develectron-vite dev
dev:clinpx node-gyp rebuild --directory=node_modules/better-sqlite3 && tsx src/cli/index.ts --port 3456 --no-web
dev:standaloneconcurrently -n gateway,panel -c blue,green 'npm run dev:cli' 'wait-on http://127.0.0.1:3456/health && npm run dev:web'
dev:webvite --config vite.web.config.ts --open /src/renderer/
postinstallelectron-rebuild 2>/dev/null || npm rebuild better-sqlite3 2>/dev/null || true
predevelectron-rebuild
prepublishOnlynpm run build:all
startelectron-vite preview
testvitest run --config tests/vitest.config.ts
test:watchvitest --config tests/vitest.config.ts

Dependencies28

@anthropic-ai/tokenizer^0.0.4
@electron-toolkit/preload^3.0.0
@electron-toolkit/utils^3.0.0
@tanstack/react-table^8.17.0
better-sqlite3^12.6.2
clsx^2.1.0
commander^12.1.0
croner^10.0.1
date-fns^3.6.0
electron-log^5.4.3
express^5.1.0
gpt-tokenizer^3.4.0
i18next^26.2.0
i18next-browser-languagedetector^8.2.1
jsonrepair^3.13.3
lucide-react^0.555.0
pino^9.14.0
pino-pretty^11.3.0
proxy-agent^7.0.0
react^18.2.0
react-dom^18.2.0
react-i18next^17.0.8
react-router-dom^6.23.0
recharts^2.12.0
tailwind-merge^2.2.0
uuid^13.0.0
zod^3.24.1
zustand^4.5.0