Package evidence

[email protected]

Install Lifecycle Suppresses Failure: postinstall="node scripts/postinstall.cjs || exit 0"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 13
Versions published: 9
First published: May 2026
Publisher: muonroi

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publishermuonroi

Artifact bytes1,767,460

Previous version1.4.0

Published2026-06-12T15:41:15.107Z

SHA-256cbede960d2d4bebb6e8b45b4c3e5368d0083814d47f24e5586d97335b0920f62

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="node scripts/postinstall.cjs || exit 0"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

6h agoLast checked

highRisk

25Score

1.4.1Version

Status history (1 event)

new → available6h ago · risk high · score 25 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Suppresses Failure	package.json	postinstall="node scripts/postinstall.cjs \|\| exit 0"	20
medium	New Account With Lifecycle Hook	package.json	package first published 37 day(s) ago, 9 total version(s), has lifecycle hook	10

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Suppresses Failure	package.json	postinstall="node scripts/postinstall.cjs \|\| exit 0"	20
medium	New Account With Lifecycle Hook	package.json	package first published 37 day(s) ago, 9 total version(s), has lifecycle hook	10
low	Install-time lifecycle script	package.json	postinstall="node scripts/postinstall.cjs \|\| exit 0"	5

Manifest

Package metadata

Scripts25

buildnode scripts/sync-version.cjs && tsc && node scripts/fix-extensions.cjs && node -e "require('fs').cpSync('src/models/catalog.json', 'dist/src/models/catalog.json', { recursive: true })"
build:binarybun build --compile --outfile ./dist/muonroi-cli-standalone ./src/index.ts
build:corecd packages/agent-harness-core && bun run build
clean:metagit clean -fdX -- .scratch chat-export-*.txt .ee-ingest-state.json .brain-*.tmp 2>/dev/null || echo 'clean:meta: no matching untracked ignored files or git unavailable'
devnode scripts/sync-version.cjs && bun run src/index.ts
ee:ingest-bbbun run scripts/ingest-bb-to-ee.mts
formatbiome format src/
format:fixbiome format --write src/
lintbiome check src/
lint:fixbiome check --fix src/
lint:harness-skipsbun run scripts/check-harness-skips.ts
lint:harness-skips:strictbun run scripts/check-harness-skips.ts --strict
lint:semanticbun scripts/check-semantic-wrap.ts
postinstallnode scripts/postinstall.cjs || exit 0
pre-commitlint-staged
preparehusky
startbun run dist/index.js
testbunx vitest run
test:angularbunx vitest -c packages/agent-harness-angular/vitest.config.ts run
test:corebunx vitest run packages/agent-harness-core/__tests__/
test:harnessbunx vitest -c vitest.harness.config.ts run tests/harness/
test:harness-angularbunx vitest -c vitest.harness-angular.config.ts run tests/harness-angular/
test:harness-reactbunx vitest -c packages/agent-harness-react/vitest.config.ts run
test:watchbunx vitest
typechecktsc --noEmit

Dependencies30

@ai-sdk/anthropic3.0.72
@ai-sdk/google3.0.65
@ai-sdk/mcp1.0.37
@ai-sdk/openai3.0.54
@ai-sdk/openai-compatible2.0.42
@ai-sdk/provider3.0.9
@ai-sdk/provider-utils4.0.24
@modelcontextprotocol/sdk1.29.0
@npmcli/arborist^9.4.3
@opentui/core0.1.107
@opentui/react0.1.107
@qdrant/js-client-rest1.17.0
ai6.0.169
better-sqlite3^12.10.0
commander^12.1.0
diff^8.0.3
fast-xml-parser^4.4.1
gpt-tokenizer^3.4.0
keytar7.9.0
ollama-ai-provider-v21.5.5
proper-lockfile^4.1.2
react19.2.5
ripgrep^0.3.1
semver^7.7.4
tree-sitter-python^0.25.0
tree-sitter-typescript^0.23.2
vscode-jsonrpc8.2.1
vscode-languageserver-types3.17.5
web-tree-sitter0.26.8
zod^4.3.6