Package evidence

@mbc-cqrs-serverless/[email protected]

Install-time lifecycle script: postinstall="prisma generate"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 116Mature · −50% score
First published: Oct 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@mbc-cqrs-serverless/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@mbc-cqrs-serverless/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes376,127

Previous version1.2.7-beta.0

Published2026-05-21T04:34:28.142Z

SHA-256627dacaba112d1ece428e4fa8a97aefde73d5290a583bd3a8505c45f845efd9d

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="prisma generate"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

11d agoLast checked

reviewRisk

2Score

1.3.0Version

Status history (1 event)

new → available11d ago · risk review · score 2 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 5 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="prisma generate"	5
low	Credential file access	package/templates/infra-local/docker-compose.yml	matched "AWS_ACCESS_KEY"	3
low	Obfuscation Density	package/templates/infra-local/appsync-simulator/package-lock.json	high encoded/escaped-token density	0
low	Obfuscation Density	package/templates/infra-local/cognito-local/package-lock.json	high encoded/escaped-token density	0
low	Obfuscation Density	package/templates/package-lock.json	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts31

buildnest build --watch
build:prodnest build
formatprettier --write "src/**/*.ts" "test/**/*.ts"
generate:swaggernest start --entryFile generate-swagger
linteslint "{src,apps,libs,test}/**/*.ts" --fix
migratenpm run migrate:rds && npm run migrate:ddb
migrate:ddbts-node prisma/ddb.ts
migrate:devprisma migrate dev
migrate:rdsprisma migrate deploy
offline:dockerrun-script-os
offline:docker:buildrun-script-os
offline:docker:build:defaultln -f .env $PWD/infra-local/.env && cd infra-local && docker compose up --build --remove-orphans
offline:docker:build:win32powershell -Command "Copy-Item '.env' -Destination './infra-local/.env'; Set-Location infra-local; docker compose up --build --remove-orphans"
offline:docker:defaultln -f .env $PWD/infra-local/.env && cd infra-local && mkdir -p docker-data/.cognito && cp -r cognito-local/db docker-data/.cognito && docker compose up --remove-orphans
offline:docker:win32powershell -Command "Copy-Item '.env' -Destination './infra-local/.env'; Set-Location infra-local; New-Item -ItemType Directory -Force -Path 'docker-data/.cognito'; Copy-Item -Recurse -Force 'cognito-local/db' 'docker-data/.cognito'; docker compose up --remove-orphans"
offline:slsrun-script-os
offline:sls:default/bin/bash ./infra-local/scripts/resources.sh && /bin/bash ./infra-local/scripts/trigger_ddb_stream.sh & ln -f .env $PWD/infra-local/.env && cd infra-local && NODE_ENV=development AWS_ACCESS_KEY_ID=DUMMYIDEXAMPLE AWS_SECRET_ACCESS_KEY=DUMMYEXAMPLEKEY SLS_DEBUG=* serverless offline start
offline:sls:win32npm run resources:win32 && concurrently "npm run trigger-ddb:win32" "npm run sls:win32"
postinstallprisma generate
resources:win32powershell -ExecutionPolicy Bypass -File ./infra-local/scripts/resources.ps1
sls:win32powershell -Command " Copy-Item ".env" -Destination ".\infra-local\.env" "; Set-Location infra-local; $env:NODE_ENV='development'; $env:AWS_ACCESS_KEY_ID='DUMMYIDEXAMPLE'; $env:AWS_SECRET_ACCESS_KEY='DUMMYEXAMPLEKEY'; $env:SLS_DEBUG='*'; serverless offline start"
startnest start
start:devnest start --watch
start:prodnode dist/main
start:replnest start --watch --entryFile repl
testjest
test:covjest --coverage
test:debugnode --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand
test:e2ejest --config ./test/jest-e2e.json
test:watchjest --watch
…and 1 more.

Dependencies3

@mbc-cqrs-serverless/core
@prisma/client^5.7.1
prisma^5.7.1

Optional dependencies13

@aws-sdk/client-dynamodb^3.606.0
@aws-sdk/client-s3^3.608.0
@aws-sdk/client-sesv2^3.608.0
@aws-sdk/client-sfn^3.606.0
@aws-sdk/client-sns^3.606.0
@aws-sdk/client-sqs^3.606.0
@aws-sdk/client-ssm^3.606.0
@aws-sdk/credential-provider-node^3.600.0
@aws-sdk/lib-storage^3.608.0
@aws-sdk/s3-request-presigner^3.608.0
@aws-sdk/signature-v4^3.374.0
@aws-sdk/util-create-request^3.598.0
@aws-sdk/util-dynamodb^3.606.0