PkgRadar

Package evidence

[email protected]

Install Lifecycle Suppresses Failure: postinstall="git config core.hooksPath .githooks 2>/dev/null || true"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,062Niche · −30% score
Versions published
20
First published
May 2026
Publisher
webappski

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherwebappski
Artifact bytes3,143,599
Previous version1.3.2
Published2026-06-16T13:55:50.983Z
SHA-25694b3e28600327a74e624052389d0aceee6f935de06c7bbda26f1790101c77f83

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="git config core.hooksPath .githooks 2>/dev/null || true"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
17Score
1.4.0Version
Status history (1 event)
  1. new → available · risk high · score 17 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"20
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="git config core.hooksPath .githooks 2>/dev/null || true"5

Manifest

Package metadata

Scripts85
  • postinstallgit config core.hooksPath .githooks 2>/dev/null || true
  • prepublishOnlynpm test && npm run test:pack-files && bash scripts/smoke-tarball.sh
  • testnpm run test:syntax && npm run test:imports && npm run test:cli && npm run test:validator && npm run test:extract && npm run test:sentiment && npm run test:outreach && npm run test:crawlability && npm run test:category && npm run test:queries && npm run test:geo && npm run test:mdhtml && npm run test:htmlrender && npm run test:uvi && npm run test:topics && npm run test:csv && npm run test:logs && npm run test:ads && npm run test:utm && npm run test:authority && npm run test:authority-profiles && npm run test:authority-github && npm run test:authority-legacy && npm run test:topdomains && npm run test:depth && npm run test:quality && npm run test:pipeline && npm run test:position && npm run test:keys && npm run test:resilience && npm run test:recovery && npm run test:spinner && npm run test:design-lint && npm run test:sections-recs && npm run test:empty-blocks && npm run test:sections-copy && npm run test:diff && npm run test:sections-integrity && npm run test:mc-metadata && npm run test:own-domain && npm run test:tpm-ledger && npm run test:tpm-ledger-persist && npm run test:ledger-store && npm run test:competitor-owned-host && npm run test:cost-untracked-model && npm run test:rate-limits && npm run test:scheduler && npm run test:live-rows && npm run test:discover && npm run test:openai && npm run test:anthropic && npm run test:main-options && npm run test:fetch-timeout && npm run test:suggested-commands && npm run test:validator-recovery-dedup && npm run test:validator-recovery-pool-filter && npm run test:init-pool-validation && npm run test:brainstorm-commercial-only && npm run test:silent-substitute && npm run test:live-rows-countdown && npm run test:recovery-honest-reason && npm run test:recovery-honest-header && npm run test:canonical-url && npm run test:mc-bridge-lang && npm run test:mc-bridge-prompt-shape && npm run test:sections-portal-link && npm run test:mc-metadata-jsdoc && npm run test:authority-wikipedia && npm run test:cell-actions && npm run test:replay-malformed && npm run test:replay-skips-discovery && npm run test:fetch-ladder && npm run test:seed-cache && npm run test:topup && npm run test:clean-category && npm run test:prompt-guards && npm run test:fail-guards && npm run test:single-key && npm run test:model-drift && npm run test:version-awareness && npm run test:e2e
  • test:adsnode test/ads-detector.test.js
  • test:anthropicnode test/anthropic.test.js
  • test:authoritynode test/authority-presence.test.js
  • test:authority-githubnode test/authority-github.test.js
  • test:authority-legacynode test/authority-legacy-shape.test.js
  • test:authority-profilesnode test/authority-profiles.test.js
  • test:authority-wikipedianode test/authority-presence-wikipedia.test.js
  • test:brainstorm-commercial-onlynode test/brainstorm-commercial-only.test.js
  • test:canonical-urlnode test/canonical-url.test.js
  • test:categorynode test/domain-category.test.js
  • test:cell-actionsnode test/report-cell-actions.test.js
  • test:clean-categorynode test/clean-category.test.js
  • test:clinode test/cli-smoke.test.js
  • test:competitor-owned-hostnode test/competitor-owned-host.test.js
  • test:cost-untracked-modelnode test/cost-untracked-model.test.js
  • test:crawlabilitynode test/crawlability-audit.test.js
  • test:csvnode test/csv-export.test.js
  • test:depthnode test/depth.test.js
  • test:design-lintnode test/design-lint.test.js
  • test:diffnode test/diff.test.js
  • test:discovernode test/discover.test.js
  • test:e2enode --test test/e2e/*.test.js
  • test:empty-blocksnode test/report-empty-blocks.test.js
  • test:extractnode test/extract-competitors-llm.test.js
  • test:fail-guardsnode test/fail-branch-guards.test.js
  • test:fetch-laddernode test/fetch-site-ladder.test.js
  • test:fetch-timeoutnode test/fetch-with-timeout.test.js
  • …and 55 more.