PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: postinstall="node scripts/auto-setup.js"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
41
Versions published
136Established · −30% score
First published
Oct 2025
Publisher
jee1

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherjee1
Artifact bytes3,010,776
Previous version1.28.0-b
Published2026-06-15T10:21:21.957Z
SHA-25626e1d624311de613d5e161c49abb21293c44c78c6c6865e5445265be9315f62b

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node scripts/auto-setup.js"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
1.28.0-cVersion
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node scripts/auto-setup.js"5

Manifest

Package metadata

Scripts118
  • backup:embeddingsnode scripts/backup-embeddings.js
  • benchmark:consolidation-qualitytsx packages/memento-core/src/test/consolidation-search-quality-benchmark.ts
  • buildnpm run build:packages
  • build:clientnpm run build -w @memento/client
  • build:packagesnpm run build -w @memento/agent-integration && npm run build -w @memento/core && npm run build -w memento-server && npm run build -w @memento/client && npm run build -w @memento/assistant && npm run sync:root-server-dist
  • build:rootnpm run build -w memento-server && npm run sync:root-server-dist
  • clean:clientnpm run clean -w @memento/client
  • copy:assetsnpm run copy:assets -w @memento/core
  • db:check-migrationtsx packages/memento-server/src/scripts/check-migration-status.ts
  • db:check-migration:helpecho 'Usage: npm run db:check-migration [database-path]'
  • db:check-triggertsx scripts/check-and-fix-trigger.ts
  • db:fix-triggertsx scripts/check-and-fix-trigger.ts --fix
  • db:initnpm run db:init -w @memento/core
  • db:migratenpm run db:migrate -w @memento/core
  • debug:embeddingsnode scripts/debug-embeddings.js
  • devnpm run dev -w memento-server
  • dev:clientnpm run dev -w @memento/client
  • dev:httpnpm run dev:http -w memento-server
  • dev:http-v2npm run dev:http-v2 -w memento-server
  • docker:builddocker-compose build
  • docker:devdocker-compose -f docker-compose.dev.yml up -d
  • docker:dev:logsdocker-compose -f docker-compose.dev.yml logs -f
  • docker:downdocker-compose down
  • docker:logsdocker-compose logs -f
  • docker:proddocker-compose -f docker-compose.prod.yml up -d
  • docker:prod:logsdocker-compose -f docker-compose.prod.yml logs -f
  • docker:updocker-compose up -d
  • docs:audit-linksnode scripts/audit-markdown-links.mjs
  • docs:verify-npm-scriptsnode scripts/verify-doc-npm-scripts.mjs
  • fix:tfidf-dimensionstsx scripts/fix-tfidf-dimensions.ts
  • …and 88 more.
Dependencies18
  • @google/genai^1.21.0
  • @google/generative-ai^0.24.1
  • @iarna/toml^2.2.5
  • @memento/core1.17.0
  • @modelcontextprotocol/sdk^1.18.2
  • @xenova/transformers^2.17.2
  • axios^1.12.2
  • better-sqlite3^12.4.1
  • cors^2.8.5
  • dotenv^16.3.1
  • express^5.1.0
  • node-fetch^3.3.2
  • openai^4.20.1
  • sharp^0.34.4
  • sqlite-vec^0.1.9
  • uuid^9.0.1
  • ws^8.18.3
  • zod^3.22.4