Package evidence

[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 13
First published: Jan 2026
Publisher: xuqian528

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherxuqian528

Artifact bytes319,862

Previous version1.0.11

Published2026-05-29T09:52:50.873Z

SHA-25662399395104b9d79aa0e4f048fc7fbb17219553b8bc753374742bee9ce20e60c

Why flagged

What the scanner saw

Install Lifecycle Remote Or Exec: postinstall="node -e \"if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}\""

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

4d agoLast checked

highRisk

35Score

1.0.12Version

Status history (1 event)

new → available19d ago · risk high · score 35 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}\""	30

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}\""	30
low	Install-time lifecycle script	package.json	postinstall="node -e \"if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}\""	5

Manifest

Package metadata

Scripts17

buildnpm run build:lib && pnpm -C apps/web run build:cf
build-fontnode build-font.js
build-reactnode build-react.js
build-vue:generatenode build-vue.js
build:cfpnpm -C apps/web build:cf
build:jstsup src/icons/index.ts --format esm,cjs --dts --minify --treeshake --out-dir dist --external react --external react-dom
build:libnode scripts/update-icons.js && node build-react.js && tsup src/icons/index.ts --format esm,cjs --dts --minify --treeshake --clean --out-dir dist --external react --external react-dom && tsup src/native/index.ts --format esm,cjs --dts --minify --treeshake --clean --out-dir dist/native --external react --external react-native --external react-native-svg && node build-font.js && npm run build:vue
build:vuenode build-vue.js && tsup packages/finicon-vue/src/index.ts --tsconfig packages/finicon-vue/tsconfig.json --format esm,cjs --dts --minify --treeshake --clean --out-dir packages/finicon-vue/dist --external vue
clean:iconssvgo -f icons -r --config svgo.config.js
deploypnpm -C apps/web deploy
devpnpm -C apps/web dev
icons:normalize-blacknode scripts/normalize-icon-black.js
icons:normalize-black:drynode scripts/normalize-icon-black.js --dry-run
icons:updatenode scripts/update-icons.js
postinstallnode -e "if(require('fs').existsSync('scripts/sync-web-icons.js')){require('child_process').execSync('npm run build:lib',{stdio:'inherit'})}"
publish:vuenode -e "require('child_process').execSync('npm publish',{stdio:'inherit',cwd:'packages/finicon-vue'})"
publish:vue:drynode -e "require('child_process').execSync('npm publish --dry-run',{stdio:'inherit',cwd:'packages/finicon-vue'})"

Dependencies14

@radix-ui/react-dialog^1.1.15
@radix-ui/react-label^2.1.8
@radix-ui/react-popover^1.1.15
@radix-ui/react-scroll-area^1.2.10
@radix-ui/react-separator^1.1.8
@radix-ui/react-slider^1.3.6
@radix-ui/react-slot^1.2.4
@radix-ui/react-tooltip^1.2.8
class-variance-authority^0.7.1
clsx^2.1.1
framer-motion^12.23.26
lucide-react^0.554.0
next-themes^0.4.6
tailwind-merge^3.4.0