PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: install="node scripts/install.js"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,579Niche · −30% score
Versions published
64
First published
Mar 2026
Publisher
mertcanaltin

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishermertcanaltin
Artifact bytes5,174,451
Previous version0.18.2
Published2026-05-27T17:10:00.157Z
SHA-256470d72e65acaef04fd5dd26d644256db62b04d1299e227e5ab0e0c1f6c7b92a5

Why flagged

What the scanner saw

Install-time lifecycle script: install="node scripts/install.js"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
0.20.0Version
Status history (2 events)
  1. available → available · risk review · score 3 · status available -> available, risk high -> review, score 35 -> 3
  2. new → available · risk high · score 35 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsoninstall="node scripts/install.js"5

Manifest

Package metadata

Scripts25
  • benchnode benchmark/bench_large.js
  • bench:aot-vs-ajvnode benchmark/bench_aot_vs_ajv.mjs
  • bench:sizenode benchmark/bench_aot_size.mjs
  • buildcmake-js build --target ata
  • fuzznode tests/fuzz_differential.js
  • fuzz:longFUZZ_ITERATIONS=100000 node tests/fuzz_differential.js
  • installnode scripts/install.js
  • prebuildpkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10
  • prebuild-allnpm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64
  • prepublishOnlynode scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && ATA_ALLOW_DOC_PLACEHOLDERS=1 node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js
  • rebuildcmake-js rebuild --target ata
  • release:checknode scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js
  • testnode test.js && node tests/test_no_native.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs
  • test:aotnode tests/test_aot_build.js
  • test:aot-clinode tests/test_aot_cli_build.js
  • test:aot-differentialnode tests/test_aot_differential.js
  • test:browsernode tests/test_browser.js
  • test:compatnode tests/test_compat.js
  • test:json-suitenode tests/run_json_test_suite.js
  • test:standard-schemanode tests/test_standard_schema.js
  • test:suitenode tests/run_suite.js
  • test:tsnode tests/test_ts_gen.js
  • test:ts-corpusnode tests/test_ts_corpus.js
  • test:ts-differentialnode tests/test_ts_differential.js
  • test:typednode tests/test_typed_validator_runner.js
Dependencies3
  • node-addon-api^8.7.0
  • node-api-headers^1.8.0
  • pkg-prebuilds^1.0.0