PkgRadar

Package evidence

@steipete/[email protected]

Install Lifecycle Suppresses Failure: postinstall="chmod +x peekaboo peekaboo-mcp.js 2>/dev/null || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,731Niche · −30% score
Versions published
17Established · −30% score
First published
Nov 2025
Publisher
steipete

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@steipete/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@steipete/[email protected]"],"fail_on":"high"}'
Publishersteipete
Artifact bytes19,281,982
Previous version3.5.0
Published2026-06-13T04:24:40.990Z
SHA-256ec2ed30b3cbd99d28d1ac117c9f0fa72ae54e2f89738dd531fe8dd154f6d6839

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="chmod +x peekaboo peekaboo-mcp.js 2>/dev/null || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
17Score
3.5.1Version
Status history (1 event)
  1. new → available · risk high · score 17 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="chmod +x peekaboo peekaboo-mcp.js 2>/dev/null || true"20
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="chmod +x peekaboo peekaboo-mcp.js 2>/dev/null || true"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="chmod +x peekaboo peekaboo-mcp.js 2>/dev/null || true"5

Manifest

Package metadata

Scripts44
  • app:restart./scripts/restart-peekaboo.sh
  • benchmark:toolsApps/Playground/scripts/peekaboo-perf.sh
  • buildpnpm run build:cli
  • build:cliswift build --package-path Apps/CLI
  • build:cli:releaseswift build --configuration release --package-path Apps/CLI
  • build:polterpnpm run polter -- peekaboo -- --version
  • build:swift./scripts/build-swift-arm.sh
  • build:swift:all./scripts/build-swift-universal.sh
  • check:changedpnpm run test:safe
  • crabbox:hydratecrabbox actions hydrate
  • crabbox:runcrabbox run
  • crabbox:stopcrabbox stop
  • crabbox:warmupcrabbox warmup
  • docs:listnode scripts/docs-list.mjs
  • docs:sitenode scripts/build-docs-site.mjs
  • formatpnpm run format:swift
  • format:swiftswiftformat .
  • lintpnpm run lint:swift
  • lint:docsnode scripts/docs-lint.mjs
  • lint:swiftswiftlint lint --config .swiftlint.yml
  • oraclepnpm -C ../oracle oracle
  • peekabooFORCE_COLOR=1 CLICOLOR_FORCE=1 NODE_PATH=../poltergeist/node_modules script -q /dev/null ./scripts/poltergeist-wrapper.sh peekaboo
  • peekaboo:devpnpm run polter:dev -- peekaboo
  • polterFORCE_COLOR=1 CLICOLOR_FORCE=1 NODE_PATH=../poltergeist/node_modules script -q /dev/null node ../poltergeist/dist/polter.js
  • polter:devFORCE_COLOR=1 CLICOLOR_FORCE=1 NODE_PATH=../poltergeist/node_modules pnpm --dir ../poltergeist exec tsx ../poltergeist/src/polter.ts
  • poltergeist:haunt./scripts/poltergeist-wrapper.sh haunt
  • poltergeist:logs./scripts/poltergeist-wrapper.sh logs
  • poltergeist:rest./scripts/poltergeist-wrapper.sh rest
  • poltergeist:start./scripts/poltergeist-wrapper.sh start
  • poltergeist:status./scripts/poltergeist-wrapper.sh status
  • …and 14 more.