PkgRadar

Package evidence

[email protected]

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
377
Versions published
40Established · −30% score
First published
Oct 2025
Publisher
moesaif

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishermoesaif
Artifact bytes1,002,904
Previous version0.6.36
Published2026-06-15T18:12:29.431Z
SHA-2561aa14d718a9dffa4c21908081f61f7ace839102747ace6288dbc12eb21246022

Why flagged

What the scanner saw

Js Hidden Powershell: Hidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
31Score
0.6.37Version
Status history (1 event)
  1. new → available · risk review · score 31 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Hidden Powershellpackage/dist/mcp/config.jsHidden / non-interactive PowerShell invocation in package code — `-WindowStyle Hidden`, `irm | iex`, `windowsHide: true`, or equivalent — used to download-and-run payloads on Windows installers.45

Manifest

Package metadata

Scripts4
  • buildtsc -p tsconfig.json
  • devtsx src/index.ts
  • release./scripts/release.sh
  • testtsx scripts/verify-no-bare-require.ts && tsx scripts/verify-agent-tools.ts && tsx scripts/verify-slash-commands.ts && tsx scripts/verify-slash-detection.ts && tsx scripts/verify-agent-queue.ts && tsx scripts/verify-agent-session.ts && tsx scripts/verify-session-branches.ts && tsx scripts/verify-session-compaction.ts && tsx scripts/verify-session-migrate.ts && tsx scripts/verify-skills.ts && tsx scripts/verify-attachments.ts && tsx scripts/verify-message-multimodal.ts && tsx scripts/verify-tool-output-ceiling.ts && tsx scripts/verify-bash-mode.ts && tsx scripts/verify-file-expansion.ts && tsx scripts/verify-output-sanitize.ts && tsx scripts/verify-trust-store.ts && tsx scripts/verify-trust-gate.ts && tsx scripts/verify-command-classifier.ts && tsx scripts/verify-fast-tool-render.ts && tsx scripts/verify-context-window.ts && tsx scripts/verify-budget.ts && tsx scripts/verify-shell-cd.ts && tsx scripts/verify-agent-loop-limits.ts && tsx scripts/verify-error-context.ts && tsx scripts/verify-edit-engine.ts && tsx scripts/verify-read-truncation.ts && tsx scripts/verify-provider-errors.ts && tsx scripts/verify-output-accumulator.ts && tsx scripts/verify-file-finder.ts && tsx scripts/verify-tui-adapter.ts && tsx scripts/verify-diff-preview.ts && tsx scripts/verify-usage-tracking.ts && tsx scripts/verify-mcp-oauth.ts && tsx scripts/verify-prompt-history.ts && tsx scripts/verify-history-search.ts && tsx scripts/verify-permission-mode.ts
Dependencies29
  • @babel/parser^7.28.4
  • @babel/traverse^7.28.4
  • @modelcontextprotocol/sdk^1.19.1
  • @types/inquirer^9.0.9
  • ansi-escapes^7.1.1
  • boxen^8.0.1
  • chalk^5.3.0
  • cli-boxes^4.0.1
  • cli-highlight^2.1.11
  • cli-table3^0.6.5
  • commander^12.0.0
  • diff^5.2.0
  • dotenv^16.4.0
  • get-east-asian-width1.6.0
  • glob^11.0.0
  • gpt-tokenizer^3.0.1
  • inquirer^12.9.6
  • marked^15.0.12
  • marked-terminal^7.3.0
  • open^10.2.0
  • ora^8.0.0
  • prom-client^15.1.3
  • undici^6.0.0
  • vscode-languageclient^9.0.1
  • vscode-languageserver-protocol^3.17.5
  • vscode-languageserver-types^3.17.5
  • winston^3.18.3
  • yaml^2.6.0
  • zod^3.23.0