Package evidence
[email protected]
Install-time lifecycle script: postinstall="node scripts/postinstall-rebuild-sqlite.mjs"
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Install-time lifecycle script: postinstall="node scripts/postinstall-rebuild-sqlite.mjs"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 60 · status changed
Related candidates
Linked campaigns and clusters
bk201_1393
4 members · evidence strength 76Install-time lifecycle script — postinstall="node scripts/postinstall-rebuild-sqlite.mjs"
4 members · evidence strength 82Evidence
Static findings
11 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install-time lifecycle script | package.json | postinstall="node scripts/postinstall-rebuild-sqlite.mjs" | 30 |
Show all 11 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install-time lifecycle script | package.json | postinstall="node scripts/postinstall-rebuild-sqlite.mjs" | 30 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/app.js | matched "\\u6267" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/dash-header.js | matched "\\u25CF" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/filtered-list-body.js | matched "\\u6EDA" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/footer-hint.js | matched "\\u300C" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/index.js | matched "\\u001b" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/load-error-panel.js | matched "\\u52A0" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/opencode-feed-panel.js | matched "\\u63A8" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/section-title-stat.js | matched "\\u25B8" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/task-board-section.js | matched "\\u663E" | 3 |
| low | Obfuscation | package/dist/interfaces/cli/tui/task-dashboard/components/task-detail-overlay.js | matched "\\u8BE6" | 3 |
Manifest
Package metadata
Scripts53
agent-farmnode ./dist/interfaces/cli/index.jsagent-farm:devtsx src/interfaces/cli/index.tsbuildnode scripts/clean-dist.mjs && tsc -p tsconfig.json && node scripts/copy-panel-core.mjschecktsc -p tsconfig.json --noEmitci:health:localnode scripts/ci-health-local.mjscommitnode scripts/commit.mjsdevtsx src/interfaces/cli/index.tsfarm:control-planenode ./dist/interfaces/cli/index.js control-plane servefarm:cursor-sdk:smokenpm run build && node scripts/cursor-sdk-smoke.mjsfarm:dashboardnode ./dist/interfaces/cli/index.js dashboardfarm:dashboard:opencodenode ./dist/interfaces/cli/index.js dashboard --opencode-feedfarm:dashboard:opencode:devtsx src/interfaces/cli/index.ts dashboard --opencode-feedfarm:dispatchbash scripts/agent-farm-dispatch.shfarm:dispatch:batchbash scripts/agent-farm-dispatch-batch.shfarm:dispatch:batch:nodenode scripts/agent-farm-dispatch-batch.mjsfarm:dispatch:nodenode scripts/agent-farm-dispatch.mjsfarm:dispatch:psnode scripts/agent-farm-dispatch.mjsfarm:doctornode ./dist/interfaces/cli/index.js doctorfarm:doctor:cinode ./dist/interfaces/cli/index.js doctor --ci-exitfarm:initnpm run build && node ./dist/interfaces/cli/index.js project init --target-dir . --force --no-interactive --storage sqlite --environments cursor --executor opencode --workers 4farm:insightsnode ./dist/interfaces/cli/index.js insightsfarm:m1:wavenpm run build && node scripts/agent-farm-dispatch-batch.mjs .agent-farm/waves/m1-cursor-control-plane.jsonfarm:m2:wavenpm run build && node scripts/agent-farm-dispatch-batch.mjs .agent-farm/waves/m2-cursor-sdk-spike.jsonfarm:m3:wavenode scripts/ensure-built.mjs && node scripts/agent-farm-dispatch-batch.mjs examples/waves/m3-product-onboarding.jsonfarm:mcpnode ./dist/interfaces/mcp/server.jsfarm:meta:self-iter:wavenpm run build && node scripts/agent-farm-dispatch-batch.mjs test/fixtures/waves/meta-self-iter-20260510.jsonfarm:onboarding:15minnode scripts/ensure-built.mjs && node scripts/onboarding-15min-check.mjsfarm:opt:wavenpm run build && node scripts/agent-farm-recover-and-wave.mjs test/fixtures/waves/polish-opt-20260511.jsonfarm:recover-wavenpm run build && node scripts/agent-farm-recover-and-wave.mjsfarm:roadmap:wavenpm run build && node scripts/agent-farm-dispatch-batch.mjs test/fixtures/waves/roadmap-iter-20260510.json- …and 23 more.
Dependencies5
@modelcontextprotocol/sdk^1.29.0better-sqlite3^12.9.0commander^14.0.3ink^5.1.0react^18.3.1