Package evidence

[email protected]

Install-time lifecycle script: postinstall="patch-package"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherflweb123

Artifact bytes4,907,089

Previous version2.0.6

Published2026-05-21T09:41:42.919Z

SHA-2569d114ca90cec02b1f5fe99d6fa116eff8f457f0f20be8dbab762ec5d2d9157c8

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="patch-package"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

46Score

2.0.7Version

Status history (1 event)

new → available23d ago · risk high · score 46 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

flweb123

2 members · evidence strength 53

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install-time lifecycle script	package.json	postinstall="patch-package"	30
medium	Large Javascript Payload	package/dist/fl-web-component.common.js	7143463 bytes	10

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install-time lifecycle script	package.json	postinstall="patch-package"	30
medium	Large Javascript Payload	package/dist/fl-web-component.common.js	7143463 bytes	10
low	Obfuscation	package/dist/fl-web-component.common.1.js	matched "\\u3000"	3
low	Obfuscation	package/dist/fl-web-component.common.2.js	matched "\\u00B7"	3

Manifest

Package metadata

Scripts18

==============================================================
===============================================================
buildnpm run lint && vue-cli-service build --target lib --name fl-web-component --formats commonjs ./src/main.js
build:testvue-cli-service build --target lib --name fl-web-component --formats commonjs ./src/main.js
devvue-cli-service serve
linteslint "{src,packages}/**/*.{vue,js}" --fix
postinstallpatch-package
prettierprettier --write "packages/**/*.{js,css,less,scss,vue,html}"
publish:basenpm run build && npm publish --registry https://registry.npmjs.org/
publish:betanpm version prerelease --preid=beta && npm run publish:beta:base
publish:beta:basenpm run build && npm publish --tag beta --registry https://registry.npmjs.org/
publish:featnpm version minor && npm run publish:base
publish:fixnpm version patch && npm run publish:base
publish:perfnpm version major && npm run publish:base
tip1仅调试本组件不涉及业务组件,请执行dev
tip2同时调试本组件与业务组件,请执行watch
tip3发版注意: 【测试版执行publish:beta】【修改bug执行publish:fix】【新增功能执行publish:feat】【新特性执行publish:perf】
watchvue-cli-service build --watch --mode production --target lib --name fl-web-component --formats commonjs ./src/main.js

Dependencies15

camera-controls2.9.0
core-js^3.42.0
dxf-parser^1.1.2
element-ui2.15.14
fflate^0.8.2
html2canvas^1.4.1
jspdf^3.0.1
konva^9.3.12
lodash^4.17.21
meshline^3.3.1
regenerator-runtime^0.14.1
svg-pan-zoom^3.6.2
three^0.176.0
three.path^1.0.1
vue^2.6.11