Package evidence

@porscheofficial/[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"process.exit(require('node:fs').existsSync('data/data.json') ? 0 : 1)\" || pnpm run build:data"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 194
Versions published: 20
First published: Apr 2026
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@porscheofficial/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@porscheofficial/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes1,858,727

Previous version2.2.0

Published2026-05-18T11:11:10.495Z

SHA-256e6a8328b5717b5e2ad775ca947b9ee4149e5eb618f26901fc77298d881bc2dac

Why flagged

What the scanner saw

Install Lifecycle Remote Or Exec: postinstall="node -e \"process.exit(require('node:fs').existsSync('data/data.json') ? 0 : 1)\" || pnpm run build:data"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

6h agoLast checked

reviewRisk

10Score

2.2.1Version

Status history (1 event)

new → available6h ago · risk review · score 10 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"process.exit(require('node:fs').existsSync('data/data.json') ? 0 : 1)\" \|\| pnpm run build:data"	30

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"process.exit(require('node:fs').existsSync('data/data.json') ? 0 : 1)\" \|\| pnpm run build:data"	30
low	Install-time lifecycle script	package.json	postinstall="node -e \"process.exit(require('node:fs').existsSync('data/data.json') ? 0 : 1)\" \|\| pnpm run build:data"	5

Manifest

Package metadata

Scripts46

buildtsx scripts/buildData.ts && tsx scripts/buildOgImages.ts && next build
build:bintsup
build:datatsx scripts/buildThemes.ts && tsx scripts/buildData.ts
build:iconspnpm dlx @svgr/cli --typescript --no-dimensions --no-prettier --out-dir src/components/Icons -- src/icons
build:ogtsx scripts/buildOgImages.ts
check:a11ypnpm run check:a11y:source && pnpm run check:a11y:axe
check:a11y:axetsx scripts/checkA11y.ts
check:a11y:sourceeslint --config a11y.eslint.config.mjs src
check:archpnpm run check:arch:depcruise && pnpm run check:arch:eslint && pnpm run check:arch:readme && pnpm run check:arch:doccoverage && pnpm run check:arch:wikilinks && pnpm run check:arch:adr && pnpm run check:arch:version-literals
check:arch:adrtsx scripts/checkAdrUnique.ts ../../docs/decisions
check:arch:depcruisedepcruise --config .dependency-cruiser.cjs src scripts
check:arch:doccoveragetsx scripts/checkDocCoverage.ts ../..
check:arch:eslinteslint .
check:arch:readmetsx scripts/checkConfigReadmeSync.ts
check:arch:version-literalstsx scripts/check-version-literals.ts
check:arch:wikilinkstsx scripts/checkWikiLinks.ts
check:buildpnpm run check:build:routes && pnpm run check:build:links && pnpm run check:build:budget && pnpm run check:build:html && pnpm run check:build:no-node-builtins && pnpm run check:build:bundle-budget
check:build:budgettsx scripts/checkBundleBudget.ts
check:build:bundle-budgettsx scripts/check-bundle-budget.ts
check:build:htmltsx scripts/checkHtmlValidate.ts
check:build:linkslinkinator ./out/index.html --config linkinator.config.json
check:build:no-node-builtinstsx scripts/checkNoNodeBuiltins.ts
check:build:routestsx scripts/checkBuildOutput.ts
check:qualitypnpm run check:quality:knip && pnpm run check:quality:jscpd && pnpm run check:quality:naming && pnpm run check:quality:sonar && pnpm run check:quality:coverage && pnpm run check:quality:spell
check:quality:coveragevitest run --coverage
check:quality:jscpdjscpd
check:quality:knipknip
check:quality:namingbiome lint --only=style/useNamingConvention --diagnostic-level=error src scripts
check:quality:sonareslint --config sonar.eslint.config.mjs src scripts bin
check:quality:spellcspell --no-progress --no-summary --no-must-find-files '**/*.md'
…and 16 more.

Dependencies37

@11ty/gray-matter^2.0.1
@fontsource/inter^5.2.8
@porsche-design-system/components-js4.1.0
@porsche-design-system/components-react^4.1.0
@radix-ui/react-dialog^1.1.15
@resvg/resvg-js^2.6.2
@types/hast^3.0.4
@types/mdast^4.0.4
@types/node^25
@types/react^19.2.14
@types/react-dom^19.2.3
chokidar^4.0.3
citty^0.2.2
clsx^2.1.1
cmdk^1.1.1
consola^3.4.2
execa^9.6.1
html-react-parser^6.0.1
jsonc-parser^3.3.1
next^16.2.6
postcss-nested^7.0.2
postcss-preset-env^11.2.1
react^19.2.6
react-dom^19.2.6
rehype-external-links^3.0.0
rehype-highlight^7.0.2
rehype-sanitize^6.0.0
rehype-stringify^10.0.1
remark-gfm^4.0.1
remark-parse^11.0.0
…and 7 more.