PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: postinstall="node -e \"const fs=require('fs'),p=require('path'),l=p.join('node_modules','draft-ole');try{fs.mkdirSync('node_modules',{recursive:true});if(fs.lstatSync(l).isSymbolicLink())process.exit(0);}catch{}try{fs.symlinkSync('..',l,'dir');}catch(e){if(e.code!=='EEXIST')throw e;}\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
155
Versions published
2
First published
May 2026
Publisher
kazuy

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherkazuy
Artifact bytes1,308,218
Previous version0.9.0
Published2026-05-25T20:29:20.534Z
SHA-256be76d28d3c2da55c1a046c2e035a869b3e6f082121a1bcd6e9495846dda6052a

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node -e \"const fs=require('fs'),p=require('path'),l=p.join('node_modules','draft-ole');try{fs.mkdirSync('node_modules',{recursive:true});if(fs.lstatSync(l).isSymbolicLink())process.exit(0);}catch{}try{fs.symlinkSync('..',l,'dir');}catch(e){if(e.code!=='EEXIST')throw e;}\""

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
0.9.1Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node -e \"const fs=require('fs'),p=require('path'),l=p.join('node_modules','draft-ole');try{fs.mkdirSync('node_modules',{recursive:true});if(fs.lstatSync(l).isSymbolicLink())process.exit(0);}catch{}try{fs.symlinkSync('..',l,'dir');}catch(e){if(e.code!=='EEXIST')throw e;}\""5

Manifest

Package metadata

Scripts32
  • buildnode --experimental-strip-types scripts/build-runtime.ts && node --experimental-strip-types scripts/gen-tag-dsl.ts && tsup && node --experimental-strip-types scripts/build-transformer.ts
  • build:examplestsx scripts/build-examples.ts examples/interactive/*.ts examples/*.ts
  • build:runtimenode --experimental-strip-types scripts/build-runtime.ts
  • build:transformernode --experimental-strip-types scripts/build-transformer.ts
  • demo:app-countertsx scripts/build-examples.ts examples/interactive/app-counter.ts --run
  • demo:app-formtsx scripts/build-examples.ts examples/interactive/app-form.ts --run
  • demo:appspnpm demo:app-counter && pnpm demo:app-form
  • demo:card-gallerytsx scripts/build-examples.ts examples/interactive/card-gallery.ts --run
  • demo:interactivepnpm demo:mvp && pnpm demo:card-gallery && pnpm demo:priority-tasks && pnpm demo:shopping-cart
  • demo:mvptsx scripts/build-examples.ts examples/interactive/mvp-demo.ts --run
  • demo:newpnpm demo:apps && pnpm demo:pages && pnpm demo:interactive && pnpm demo:showcase
  • demo:page-landingtsx scripts/build-examples.ts examples/page-landing.ts --run
  • demo:page-minimaltsx scripts/build-examples.ts examples/page-minimal.ts --run
  • demo:page-with-app-slottsx scripts/build-examples.ts examples/page-with-app-slot.ts --run
  • demo:pagespnpm demo:page-landing && pnpm demo:page-minimal && pnpm demo:page-with-app-slot
  • demo:priority-taskstsx scripts/build-examples.ts examples/interactive/priority-tasks.ts --run
  • demo:shopping-carttsx scripts/build-examples.ts examples/interactive/shopping-cart.ts --run
  • demo:showcasepnpm demo:showcase-button && pnpm demo:showcase-card && pnpm demo:showcase-list
  • demo:showcase-buttontsx scripts/build-examples.ts examples/showcase-button.ts --run
  • demo:showcase-cardtsx scripts/build-examples.ts examples/showcase-card.ts --run
  • demo:showcase-listtsx scripts/build-examples.ts examples/showcase-list.ts --run
  • docs:apitypedoc
  • linteslint src/ tests/
  • postinstallnode -e "const fs=require('fs'),p=require('path'),l=p.join('node_modules','draft-ole');try{fs.mkdirSync('node_modules',{recursive:true});if(fs.lstatSync(l).isSymbolicLink())process.exit(0);}catch{}try{fs.symlinkSync('..',l,'dir');}catch(e){if(e.code!=='EEXIST')throw e;}"
  • testvitest run && pnpm test:types
  • test:e2eplaywright test
  • test:e2e:reportplaywright show-report
  • test:e2e:uiplaywright test --ui
  • test:typestsc -p tests/state-handler-typing/tsconfig.json --noEmit
  • test:watchvitest
  • …and 2 more.