PkgRadar

Package evidence

[email protected]

Install Lifecycle Suppresses Failure: postinstall="(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,364Niche · −30% score
Versions published
190
First published
Feb 2026
Publisher
yellowsunhy

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheryellowsunhy
Artifact bytes5,872,325
Previous version1.11.2
Published2026-06-05T04:31:32.988Z
SHA-256bfda8e079938316566f8a6c61f609b614fb768f64d44ec7e3a9cabc3fabece29

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
63Score
1.11.3Version
Status history (1 event)
  1. new → available · risk high · score 63 · status changed

Evidence

Static findings

23 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)"20
mediumRemote Payloadpackage/dist/backend/backend/src/services/browser/chrome-discovery.service.jsmatched "curl "12
mediumRemote Payloadpackage/config/skills/_common/complete-body-shape.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/create-intent-tasks/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/decompose-intent/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/update-intent-task/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/marketing/submit-for-approval/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/screenshot-compare/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/xiaoyuzhoufm-transcript/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/decompose-mission/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/decompose-okr/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/design-team/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/measure-kr/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/review-mission/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/team-leader/design-checklist/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/create-request/execute.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/reply-channel/execute.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/browse-stealth/launch-chrome-cdp.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/_common/lib.shmatched "curl "12
Show all 23 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)"20
mediumRemote Payloadpackage/dist/backend/backend/src/services/browser/chrome-discovery.service.jsmatched "curl "12
mediumRemote Payloadpackage/config/skills/_common/complete-body-shape.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/create-intent-tasks/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/decompose-intent/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/update-intent-task/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/marketing/submit-for-approval/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/screenshot-compare/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/xiaoyuzhoufm-transcript/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/decompose-mission/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/decompose-okr/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/design-team/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/measure-kr/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/orchestrator/review-mission/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/team-leader/design-checklist/execute.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/create-request/execute.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/core/reply-channel/execute.test.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/agent/browse-stealth/launch-chrome-cdp.shmatched "curl "12
mediumRemote Payloadpackage/config/skills/_common/lib.shmatched "curl "12
lowMessenger Bot Endpointpackage/dist/backend/backend/src/constants.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/dist/cli/backend/src/constants.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowCredential file accesspackage/dist/backend/backend/src/services/messaging/adapters/google-chat-messenger.adapter.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)"5

Manifest

Package metadata

Scripts37
  • buildnpm run build:backend && npm run build:frontend && npm run build:cli
  • build:backendtsc -p backend/tsconfig.json
  • build:clitsc -p cli/tsconfig.json
  • build:frontendcd frontend && npm run build
  • build:servernpm run build:backend && npm run build:cli
  • devconcurrently "npm run dev:backend" "npm run dev:frontend"
  • dev:backendnpx tsx backend/src/index.ts
  • dev:backend:debugnode --inspect --import tsx backend/src/index.ts
  • dev:backend:watchnpx tsx watch backend/src/index.ts
  • dev:frontendcd frontend && npm run dev
  • docker:builddocker build -t crewly .
  • docker:compose:downdocker-compose down
  • docker:compose:logsdocker-compose logs -f
  • docker:compose:updocker-compose up -d
  • docker:rundocker run -p 8788:8788 crewly
  • eval:l4npx tsx backend/src/services/agent/crewly-agent/eval/run-eval-l4.ts
  • linteslint . --ext .ts,.tsx
  • logs:pm2pm2 logs
  • monit:pm2pm2 monit
  • postinstall(npm rebuild node-pty --build-from-source 2>/dev/null || npm rebuild node-pty 2>/dev/null || true) && (npm rebuild better-sqlite3 2>/dev/null || true)
  • prepublishOnlynpm run build
  • reload:pm2pm2 reload ecosystem.config.js
  • restart:pm2pm2 restart ecosystem.config.js
  • startnode dist/cli/cli/src/index.js start
  • start:pm2pm2 start ecosystem.config.js
  • stop:pm2pm2 stop ecosystem.config.js
  • testjest
  • test:backendjest tests/unit tests/integration
  • test:e2eplaywright test
  • test:e2e:headedplaywright test --headed
  • …and 7 more.
Dependencies42
  • @ai-sdk/anthropic^3.0.58
  • @ai-sdk/google^3.0.43
  • @ai-sdk/openai^3.0.41
  • @opentelemetry/api^1.9.0
  • @opentelemetry/exporter-trace-otlp-http^0.213.0
  • @opentelemetry/instrumentation-express^0.61.0
  • @opentelemetry/instrumentation-http^0.213.0
  • @opentelemetry/resources^2.6.0
  • @opentelemetry/sdk-node^0.213.0
  • @opentelemetry/sdk-trace-node^2.6.0
  • @opentelemetry/semantic-conventions^1.40.0
  • @supabase/supabase-js^2.99.0
  • @types/better-sqlite3^7.6.13
  • @xterm/headless^6.0.0
  • ai^6.0.116
  • ajv^8.18.0
  • axios^1.11.0
  • better-sqlite3^12.8.0
  • chalk^5.3.0
  • chokidar^3.5.3
  • commander^11.0.0
  • cors^2.8.5
  • cron-parser^5.5.0
  • dotenv^17.2.3
  • express^4.18.2
  • helmet^8.1.0
  • ioredis^5.10.1
  • jsonwebtoken^9.0.3
  • mongodb^7.1.0
  • morgan^1.10.1
  • …and 12 more.
Optional dependencies3
  • @modelcontextprotocol/sdk^0.5.0
  • @slack/bolt^3.22.0
  • @whiskeysockets/baileys^7.0.0-rc.9