PkgRadar

Package evidence

@mindflight/[email protected]

Install-time lifecycle script: postinstall="node ./bin/lib/postinstall-prebuilds.mjs"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
464
Versions published
18
First published
Apr 2026
Publisher
lanfeust21

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@mindflight/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@mindflight/[email protected]"],"fail_on":"review"}'
Publisherlanfeust21
Artifact bytes1,655,963
Previous version0.5.2
Published2026-06-12T13:48:19.472Z
SHA-256fe61eac84c023e724f844e94704f838c7d332cbd1f6b345f26b5d92470fc5352

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node ./bin/lib/postinstall-prebuilds.mjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
0.5.3Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node ./bin/lib/postinstall-prebuilds.mjs"5

Manifest

Package metadata

Scripts47
  • backend:buildsh scripts/backend-build-full.sh
  • backend:build:debugcd cmd/backend && ZIG_LOCAL_CACHE_DIR="${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}" ZIG_GLOBAL_CACHE_DIR="${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}" "${ZIG:-zig}" build
  • backend:devGHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend
  • backend:ensure-vendorscripts/ensure-vendor.sh
  • backend:sqlite3scripts/download-sqlite3.sh
  • beta:bundlenode scripts/make-beta-bundle.mjs
  • beta:smokenode scripts/smoke-beta-install.mjs
  • beta:smoke:idenode scripts/smoke-beta-ide-install.mjs
  • buildtsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs
  • cleanrm -rf coverage dist
  • demo:loadtsx src/cli/demo-load.ts
  • demo:load:starterkittsx src/cli/demo-load.ts --profile-file examples/starterkit-perso/starterkit-default.jsonl
  • devtsx src/index.ts
  • embeddings:backfilltsx src/cli/embeddings-backfill.ts
  • formatprettier --write .
  • format:checkprettier --check .
  • linteslint .
  • migratetsx src/cli/migrate.ts
  • ontology:compilenode bin/gcp.mjs brain ontology compile
  • ontology:export-linkmlnode bin/gcp.mjs brain ontology export-linkml
  • pack:localpnpm run prebuild:all && pnpm run build && node scripts/pack-local.mjs
  • pack:local:reuse-prebuildspnpm run build && node scripts/pack-local.mjs
  • postinstallnode ./bin/lib/postinstall-prebuilds.mjs
  • prebuild:allsh scripts/prebuilds-all.sh
  • prebuild:localpnpm run prebuild:all
  • prebuild:stage-packagesnode scripts/stage-platform-packages.mjs
  • publish:npm-splitnode scripts/publish-npm-split.mjs
  • smoke:backendscripts/smoke-backend.sh
  • smoke:example-clientnode scripts/example-client-smoke.mjs
  • smoke:mcpnode scripts/mcp-smoke.mjs
  • …and 17 more.
Dependencies3
  • @modelcontextprotocol/sdk^1.27.1
  • yaml^2.8.3
  • zod^4.3.6
Optional dependencies6
  • @mindflight/ghostcrab-personal-mcp-darwin-arm640.5.3
  • @mindflight/ghostcrab-personal-mcp-darwin-x640.5.3
  • @mindflight/ghostcrab-personal-mcp-linux-arm640.5.3
  • @mindflight/ghostcrab-personal-mcp-linux-x640.5.3
  • @mindflight/ghostcrab-personal-mcp-win32-arm640.5.3
  • @mindflight/ghostcrab-personal-mcp-win32-x640.5.3