PkgRadar

Package evidence

@tdesign/[email protected]

Install Lifecycle Suppresses Failure: postinstall="node dist/script/postinstall.js || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,117Niche · −30% score
Versions published
8
First published
Jan 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@tdesign/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@tdesign/[email protected]"],"fail_on":"high"}'
PublisherGitHub Actions
Artifact bytes478,076
Previous version0.8.0
Published2026-04-09T10:07:01.463Z
SHA-2568d24522a262477d4ea0dc88691ce201e2759559ef076bdbd7e4a5adf4af5dbe7

Why flagged

What the scanner saw

New Lifecycle Script Vs Previous: postinstall added in 0.8.1 vs 0.8.0: "node dist/script/postinstall.js || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
65Score
0.8.1Version
Status history (1 event)
  1. new → available · risk high · score 65 · status changed

Evidence

Static findings

2 static · 1 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 0.8.1 vs 0.8.0: "node dist/script/postinstall.js || true"40
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node dist/script/postinstall.js || true"20
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 0.8.1 vs 0.8.0: "node dist/script/postinstall.js || true"40
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="node dist/script/postinstall.js || true"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node dist/script/postinstall.js || true"5

Manifest

Package metadata

Scripts36
  • buildpnpm --filter="./site" build && pnpm --filter="./example" build:h5
  • build:mpnpm run build:mp-weixin
  • build:mp-alipaypnpm --filter="./example" build:mp-alipay
  • build:mp-baidupnpm --filter="./example" build:mp-baidu
  • build:mp-jdpnpm --filter="./example" build:mp-jd
  • build:mp-kuaishoupnpm --filter="./example" build:mp-kuaishou
  • build:mp-larkpnpm --filter="./example" build:mp-lark
  • build:mp-qqpnpm --filter="./example" build:mp-qq
  • build:mp-toutiaopnpm --filter="./example" build:mp-toutiao
  • build:mp-weixinpnpm --filter="./example" build:mp-weixin
  • build:mp-xhspnpm --filter="./example" build:mp-xhs
  • build:npmnpm run init && npm run release:prepare
  • commitgit-cz
  • devconcurrently "npm run watch" "pnpm --filter="./example" dev:h5" "pnpm --filter="./site" dev"
  • dev:h5concurrently "npm run watch" "pnpm --filter="./example" dev:h5"
  • dev:mpnpm run dev:mp-weixin
  • dev:mp-alipayconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-alipay"
  • dev:mp-baiduconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-baidu"
  • dev:mp-jdconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-jd"
  • dev:mp-kuaishouconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-kuaishou"
  • dev:mp-larkconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-lark"
  • dev:mp-qqconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-qq"
  • dev:mp-toutiaoconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-toutiao"
  • dev:mp-weixinconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-weixin"
  • dev:mp-xhsconcurrently "npm run watch" "pnpm --filter="./example" dev:mp-xhs"
  • dev:mp:purepnpm --filter="./example" dev:mp-weixin
  • gen:typesnode ./example/script/types/index.js
  • initnode ./example/script/watch/init.js && node ./example/script/pages/index.js
  • postinstallnode dist/script/postinstall.js || true
  • previewpnpm --filter="./site" run site:preview && pnpm --filter="./example" build:h5
  • …and 6 more.