PkgRadar

Package evidence

@pine-ds/[email protected]

Install Lifecycle Suppresses Failure: postinstall="node ./dist/scripts/vscode-settings-patcher.cjs || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
552
Versions published
137Mature · −50% score
First published
Dec 2023
Publisher
dss_kajabi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pine-ds/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pine-ds/[email protected]"],"fail_on":"high"}'
Publisherdss_kajabi
Artifact bytes4,546,292
Previous version3.26.1
Published2026-06-02T23:30:10.767Z
SHA-256dc5f3d0a6b2440e2f7f66839faff10c55172bef34c3cb5dc9d82a2b3627d5a20

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="node ./dist/scripts/vscode-settings-patcher.cjs || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
12Score
3.26.3Version
Status history (1 event)
  1. new → available · risk high · score 12 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node ./dist/scripts/vscode-settings-patcher.cjs || true"20
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node ./dist/scripts/vscode-settings-patcher.cjs || true"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node ./dist/scripts/vscode-settings-patcher.cjs || true"5

Manifest

Package metadata

Scripts18
  • buildnpm run build.stencil
  • build.allrun-s build.stencil build.storybook
  • build.stencilstencil build --docs && mkdir -p dist/scripts && cp scripts/vscode-settings-patcher.cjs dist/scripts/
  • build.storybookstorybook build
  • build.tstsc -p scripts/tsconfig.json
  • deploynpm run build.all
  • generatestencil generate
  • lintrun-p lint.*
  • lint.eslinteslint src
  • lint.stylesstylelint "./src/**/*.*css"
  • postinstallnode ./dist/scripts/vscode-settings-patcher.cjs || true
  • prestartnpm run build
  • prettierprettier "./src/**/*.{html,ts,tsx,js,jsx}"
  • startrun-p start.*
  • start.stencilstencil build --docs --dev --watch --serve --config=stencil.local.config.ts
  • start.storybookstorybook dev -p 6006
  • teststencil test --spec --e2e --coverage
  • test.watchstencil test --spec --e2e --watchAll --coverage
Dependencies8
  • @floating-ui/dom^1.7.0
  • @kajabi-ui/styles*
  • @pine-ds/icons*
  • @stencil/core4.38.3
  • @types/dompurify^3.0.5
  • dompurify^3.2.6
  • sortablejs^1.15.0
  • tslib^2.6.2