PkgRadar

Package evidence

@molanojustin/[email protected]

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
22Established · −30% score
First published
Oct 2025
Publisher
molanojustin

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@molanojustin/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@molanojustin/[email protected]"],"fail_on":"review"}'
Publishermolanojustin
Artifact bytes422,998
Previous version1.2.4
Published2026-03-12T22:17:34.040Z
SHA-2560e7f2171649d4e210f525e1711d7dcce1fb0bfaab5f33c79f9c3c69f720ace98

Why flagged

What the scanner saw

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
31Score
1.2.6Version
Status history (1 event)
  1. new → available · risk review · score 31 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Hidden Powershellpackage/bin/smithsonian-mcp.jsHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.45

Manifest

Package metadata

Scripts14
  • bump:majornpm version major -m "feat(release): %s" --tag-version-prefix="v"
  • bump:minornpm version minor -m "feat(release): %s" --tag-version-prefix="v"
  • bump:patchnpm version patch -m "chore(release): %s" --tag-version-prefix="v"
  • check-versionnode -e "const pkg=require('./package.json'); const fs=require('fs'); const toml=fs.readFileSync('pyproject.toml','utf8'); const match=toml.match(/^version\s*=\s*\"([^\"]+)\"/m); if(!match||pkg.version!==match[1]){console.error('❌ Version mismatch: package.json='+pkg.version+', pyproject.toml='+(match?match[1]:'not found')); process.exit(1);} console.log('✅ Versions match: '+pkg.version);"
  • docker:builddocker buildx build --platform linux/amd64,linux/arm64 -t justinmol/smithsonian-mcp:latest -t justinmol/smithsonian-mcp:v$(node -p "require('./package.json').version") .
  • docker:pushdocker buildx build --platform linux/amd64,linux/arm64 -t justinmol/smithsonian-mcp:latest -t justinmol/smithsonian-mcp:v$(node -p "require('./package.json').version") --push .
  • postversiongit push && git push --tags
  • prepublishOnlynpm run check-version && npm test
  • preversionnpm test
  • releasenpm run check-version && npm test && npm publish && npm run docker:push && git push --follow-tags
  • startnode bin/smithsonian-mcp.js
  • sync-requirementsnode scripts/sync-requirements.js
  • testnode bin/smithsonian-mcp.js --test
  • versionnode -e "const fs=require('fs'); const pkg=require('./package.json'); const toml=fs.readFileSync('pyproject.toml','utf8'); fs.writeFileSync('pyproject.toml', toml.replace(/^version\s*=\s*\"[^\"]+\"/m, 'version = \"'+pkg.version+'\"')); require('child_process').execSync('uv lock')" && npm run sync-requirements && python smithsonian_mcp/write_version.py && git add pyproject.toml uv.lock config/requirements.txt smithsonian_mcp/_version.py package.json package-lock.json
Dependencies3
  • @modelcontextprotocol/sdk^1.27.1
  • cross-spawn^7.0.6
  • dotenv^17.3.1