PkgRadar

Package evidence

[email protected]

Install Lifecycle Suppresses Failure: postinstall="git config core.hooksPath .githooks 2>/dev/null || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
14
First published
May 2026
Publisher
webappski

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherwebappski
Artifact bytes3,107,853
Previous version1.1.3
Published2026-06-08T08:11:05.515Z
SHA-2565dce9a263d8ee1cc0815a5b9fe8e696204f80881151dd32e76442ed86e12e04d

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="git config core.hooksPath .githooks 2>/dev/null || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
25Score
1.1.6Version
Status history (1 event)
  1. new → available · risk high · score 25 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"20
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"5

Manifest

Package metadata

Scripts70
  • postinstallgit config core.hooksPath .githooks 2>/dev/null || true
  • prepublishOnlynpm test && npm run test:pack-files
  • testnpm run test:syntax && npm run test:imports && npm run test:cli && npm run test:validator && npm run test:extract && npm run test:sentiment && npm run test:outreach && npm run test:crawlability && npm run test:category && npm run test:queries && npm run test:geo && npm run test:mdhtml && npm run test:htmlrender && npm run test:uvi && npm run test:topics && npm run test:csv && npm run test:logs && npm run test:ads && npm run test:utm && npm run test:authority && npm run test:authority-profiles && npm run test:authority-github && npm run test:authority-legacy && npm run test:topdomains && npm run test:depth && npm run test:quality && npm run test:pipeline && npm run test:position && npm run test:keys && npm run test:resilience && npm run test:recovery && npm run test:spinner && npm run test:design-lint && npm run test:sections-recs && npm run test:empty-blocks && npm run test:sections-copy && npm run test:diff && npm run test:sections-integrity && npm run test:mc-metadata && npm run test:own-domain && npm run test:tpm-ledger && npm run test:rate-limits && npm run test:scheduler && npm run test:live-rows && npm run test:discover && npm run test:openai && npm run test:anthropic && npm run test:main-options && npm run test:fetch-timeout && npm run test:suggested-commands && npm run test:validator-recovery-dedup && npm run test:validator-recovery-pool-filter && npm run test:init-pool-validation && npm run test:brainstorm-commercial-only && npm run test:silent-substitute && npm run test:live-rows-countdown && npm run test:recovery-honest-reason && npm run test:recovery-honest-header && npm run test:mc-bridge-lang && npm run test:sections-portal-link && npm run test:mc-metadata-jsdoc && npm run test:authority-wikipedia && npm run test:cell-actions && npm run test:replay-malformed && npm run test:replay-skips-discovery && npm run test:e2e
  • test:adsnode test/ads-detector.test.js
  • test:anthropicnode test/anthropic.test.js
  • test:authoritynode test/authority-presence.test.js
  • test:authority-githubnode test/authority-github.test.js
  • test:authority-legacynode test/authority-legacy-shape.test.js
  • test:authority-profilesnode test/authority-profiles.test.js
  • test:authority-wikipedianode test/authority-presence-wikipedia.test.js
  • test:brainstorm-commercial-onlynode test/brainstorm-commercial-only.test.js
  • test:categorynode test/domain-category.test.js
  • test:cell-actionsnode test/report-cell-actions.test.js
  • test:clinode test/cli-smoke.test.js
  • test:crawlabilitynode test/crawlability-audit.test.js
  • test:csvnode test/csv-export.test.js
  • test:depthnode test/depth.test.js
  • test:design-lintnode test/design-lint.test.js
  • test:diffnode test/diff.test.js
  • test:discovernode test/discover.test.js
  • test:e2enode --test test/e2e/*.test.js
  • test:empty-blocksnode test/report-empty-blocks.test.js
  • test:extractnode test/extract-competitors-llm.test.js
  • test:fetch-timeoutnode test/fetch-with-timeout.test.js
  • test:geonode test/geo-context.test.js
  • test:htmlrendernode test/html-render-smoke.js
  • test:importsnode -e "Promise.all(['./lib/config.js','./lib/mention.js','./lib/diff.js','./lib/init/keys.js','./lib/init/fetch-site.js','./lib/init/suggest.js','./lib/init/research/brainstorm.js','./lib/init/research/filter.js','./lib/init/research/classify-intent.js','./lib/init/research/score.js','./lib/init/research/validate-category.js','./lib/init/research/validate-query-llm.js','./lib/init/research/run-validation.js','./lib/init/research/research.js','./lib/init/research-failure-panel.js','./lib/init/validator-recovery.js','./lib/util/spinner.js','./lib/providers/openai.js','./lib/providers/gemini.js','./lib/providers/anthropic.js','./lib/providers/perplexity.js','./lib/providers/index.js','./lib/providers/classify-error.js','./lib/errors/all-engines-failed-panel.js','./lib/errors/unexpected-error-panel.js','./lib/svg/index.js','./lib/svg/radar.js','./lib/report/sections.js','./lib/report/extract-quotes.js','./lib/report/markdown.js','./lib/report/html.js','./lib/report/classify-citations.js','./lib/report/extract-competitors-llm.js','./lib/report/sentiment-classify.js','./lib/report/outreach-templates.js','./lib/report/crawlability-audit.js','./lib/report/domain-category.js','./lib/report/geo-context.js','./lib/report/markdown-to-html.js','./lib/report/visibility-index.js','./lib/report/topic-cluster.js','./lib/report/csv-export.js','./lib/report/log-parser.js','./lib/report/authority-presence.js','./lib/report/ads-detector.js','./lib/report/utm-tracker.js','./lib/config/queries-normalize.js','./lib/report/top-domains.js','./lib/providers/non-search-model.js','./lib/report/response-quality.js','./lib/report/own-domain.js'].map(f => import(f))).then(() => console.log('OK: all modules loaded')).catch(e => { console.error(e); process.exit(1); })"
  • test:init-pool-validationnode test/init-pool-validation.test.js
  • test:keysnode test/keys.test.js
  • test:live-rowsnode test/live-rows.test.js
  • …and 40 more.