PkgRadar

Package evidence

@photostructure/[email protected]

Install-time lifecycle script: install="node scripts/install.cjs"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
31Mature · −50% score
First published
Nov 2024
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@photostructure/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@photostructure/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes981,991
Previous version1.4.0
Published2026-04-28T05:54:39.570Z
SHA-25618dcd39bb76b0fecfc122948f179ea681083df874bbfda7d72ad4b29ba09e289

Why flagged

What the scanner saw

Install-time lifecycle script: install="node scripts/install.cjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
1Score
1.4.1Version
Status history (1 event)
  1. new → available · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsoninstall="node scripts/install.cjs"5

Manifest

Package metadata

Scripts37
  • // fmt:cppon ubuntu: `sudo apt install clang-format`. Note that windows emits `invalid format` with this || true approach, but it works and is better than introducing Yet Another Script Script (like scripts/clang-format.mjs).
  • // precommitshould be manually run by developers before they run `git commit`
  • // testsupport `npm t name_of_file` (and don't fail due to missing coverage)
  • buildrun-s build:native build:dist
  • build:disttsup && node scripts/post-build.mjs
  • build:linux-glibcbash scripts/prebuild-linux-glibc.sh
  • build:nativetsx scripts/prebuildify-wrapper.ts
  • check:memorytsx scripts/check-memory.ts
  • cleanrun-p clean:*
  • clean:distdel-cli coverage dist docs "*.tsbuildinfo"
  • clean:gyp-cachedel-cli --force build %USERPROFILE%/.node-gyp ~/.node-gyp
  • clean:nativenode-gyp clean
  • docstypedoc
  • fmtrun-p fmt:*
  • fmt:cppclang-format --style=LLVM -i src/*.cpp src/*/*.cpp src/*/*.h || echo "problem with clang-format"
  • fmt:jsprettier --write "**/*.{cjs,mjs,js}"
  • fmt:jsonprettier --write "**/*.json"
  • fmt:mdprettier --write "**/*.md"
  • fmt:pkgnpm pkg fix
  • fmt:tsprettier --write "**/*.{cts,mts,ts}"
  • fmt:ymlprettier --write "**/*.{yaml,yml}"
  • installnode scripts/install.cjs
  • install:pinactgo install github.com/suzuki-shunsuke/pinact/v3/cmd/pinact@latest
  • lintrun-s lint:*
  • lint:eslinteslint
  • lint:nativetsx scripts/clang-tidy.ts
  • lint:tsctsc --noEmit
  • node-gyp-rebuildnode-gyp rebuild
  • precommitnpx --yes tsx scripts/precommit.ts
  • prepare-releasenpm run build:dist
  • …and 7 more.
Dependencies2
  • node-addon-api^8.7.0
  • node-gyp-build^4.8.4