PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: postinstall="npm run plugins"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
5
Versions published
7
First published
Apr 2025
Publisher
wikigods

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherwikigods
Artifact bytes21,849,456
Previous version1.0.4
Published2026-05-26T16:27:05.080Z
SHA-25650d5a34ca691e303923cee07a5226f958739f965f626431899c494a2d9066004

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="npm run plugins"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
1.0.5Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsonpostinstall="npm run plugins"5

Manifest

Package metadata

Scripts35
  • bundlewatchbundlewatch --config .bundlewatch.config.json
  • compilenpm-run-all --parallel js css-all
  • cssnpm-run-all css-compile css-prefix css-minify
  • css-allnpm-run-all --parallel css css-splits
  • css-compilenpm run css-compile-bash -- build/scss/adminlte.scss:dist/css/adminlte.css
  • css-compile-bashsass --silence-deprecation=color-functions,global-builtin,mixed-decls,import --style=expanded --load-path="node_modules" --source-map --embed-sources --no-error-css build/scss/:dist/css/
  • css-compile-splitsnpm run css-compile-bash -- build/scss/parts:dist/css/alt/
  • css-lintstylelint "build/scss/**/*.scss" --cache --cache-location .cache/.stylelintcache --rd
  • css-minifynpm run css-minify-bash -- dist/css/ --batch --batch-suffix ".min" "dist/css/*.css" "!dist/css/*.min.css"
  • css-minify-bashcleancss -O1 --format breakWith=lf --with-rebase --source-map --source-map-inline-sources --output
  • css-minify-splitsnpm run css-minify-bash -- dist/css/alt/ --batch --batch-suffix ".min" "dist/css/alt/*.css" "!dist/css/alt/*.min.css"
  • css-prefixpostcss --config build/config/postcss.config.js --replace "dist/css/*.css" "!dist/css/*.min.css"
  • css-prefix-splitspostcss --config build/config/postcss.config.js --replace "dist/css/alt/*.css" "!dist/css/alt/*.min.css"
  • css-splitsnpm-run-all css-compile-splits css-prefix-splits css-minify-splits
  • devnpm-run-all --parallel watch sync
  • docsnpm-run-all docs-prepare docs-compile
  • docs-compilecd docs/ && bundle exec jekyll build -d ../docs_html
  • docs-lintnode build/npm/vnu-jar.js
  • docs-preparenode build/npm/DocsPublish.js -v
  • docs-servenpm-run-all compile docs-prepare && cd docs/ && bundle exec jekyll serve
  • jsnpm-run-all js-compile js-minify
  • js-compilerollup --config build/config/rollup.config.js --sourcemap
  • js-linteslint --cache --cache-location .cache/.eslintcache --report-unused-disable-directives .
  • js-minifyterser --compress typeofs=false --mangle --comments "/^!/" --source-map "content=dist/js/adminlte.js.map,includeSources,url=adminlte.min.js.map" --output dist/js/adminlte.min.js dist/js/adminlte.js
  • lintnpm-run-all --aggregate-output --continue-on-error --parallel js-lint css-lint docs-lint lockfile-lint
  • lockfile-lintlockfile-lint --allowed-hosts npm --allowed-schemes https: --empty-hostname false --type npm --path package-lock.json
  • pluginsnode build/npm/Publish.js -v
  • postinstallnpm run plugins
  • prepare-releasenpm-run-all production docs
  • productionnpm-run-all --parallel compile plugins
  • …and 5 more.
Dependencies50
  • @eonasdan/tempus-dominus^6.10.4
  • @fortawesome/fontawesome-free~7.0.1
  • @lgaitan/pace-progress^1.0.7
  • @popperjs/core~2.11.8
  • bootstrap~5.3.8
  • chart.js~4.5.1
  • codemirror~6.0.1
  • datatables.net~2.2.2
  • datatables.net-autofill-bs5~2.7.0
  • datatables.net-bs5^2.2.2
  • datatables.net-buttons-bs5^3.2.3
  • datatables.net-colreorder-bs5^2.1.0
  • datatables.net-fixedcolumns-bs5^5.0.4
  • datatables.net-fixedheader-bs5^4.0.2
  • datatables.net-keytable-bs5^2.12.1
  • datatables.net-responsive-bs5^3.0.4
  • datatables.net-rowgroup-bs5^1.5.1
  • datatables.net-rowreorder-bs5^1.5.0
  • datatables.net-scroller-bs5^2.4.3
  • datatables.net-searchbuilder-bs5^1.8.2
  • datatables.net-searchpanes-bs5^2.3.3
  • datatables.net-select-bs5^3.0.1
  • daterangepicker^3.1.0
  • dropzone^6.0.0-beta.2
  • flag-icons^7.5.0
  • flot^4.2.6
  • fs-extra^11.3.2
  • fullcalendar^6.1.19
  • icheck-bootstrap^3.0.1
  • inputmask^5.0.9
  • …and 20 more.