Package evidence

[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 11,495Mainstream · −50% score
Versions published: 117
First published: Feb 2026
Publisher: bellman_04

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherbellman_04

Artifact bytes3,906,181

Previous version0.18.10

Published2026-06-09T06:51:01.709Z

SHA-25665afae9d7cdfb2af401a6926f5c707eb8eff2a22b393bd10cf07f8afdc3dd8a7

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

36h agoLast checked

highRisk

20Score

0.18.11Version

Status history (1 event)

new → available36h ago · risk high · score 20 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\""	30

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\""	30
low	Messenger Bot Endpoint	package/dist/notifications/dispatcher.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Install-time lifecycle script	package.json	postinstall="node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\""	5

Manifest

Package metadata

Scripts49

ask:claude./src/scripts/ask-claude.sh
ask:gemini./src/scripts/ask-gemini.sh
buildnode -e "const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});" && tsc && node -e "require('fs').chmodSync('dist/cli/omx.js', 0o755)"
build:apinode dist/scripts/build-api.js
build:explorecargo build -p omx-explore-harness
build:explore:releasenode dist/scripts/build-explore-harness.js
build:fullnpm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api
build:sparkshellnode dist/scripts/build-sparkshell.js
check:no-unusedtsc -p tsconfig.no-unused.json
clean:native-package-assetsnode dist/scripts/cleanup-explore-harness.js
coverage:team-criticalnpm run build && npm run coverage:team-critical:compiled
coverage:team-critical:compiledc8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__
coverage:team-critical:cross-platformnpm run coverage:team-critical
coverage:ts:fullnpm run build && npm run coverage:ts:full:compiled
coverage:ts:full:compiledc8 --all --src dist --exclude '**/__tests__/**' --exclude 'dist/bin/**' --exclude 'dist/**/*.d.ts' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/ts-full node dist/scripts/run-test-files.js dist
coverage:ts:full:cross-platformnpm run coverage:ts:full
devtsc --watch
doctornode dist/cli/omx.js doctor
lintbiome lint src
postinstallnode -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))"
postpacknpm run clean:native-package-assets
prepacknpm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets
preparenode src/scripts/prepare-build.js
prompt:inventorynode dist/scripts/prompt-inventory.js
setupnode dist/cli/omx.js setup
smoke:packed-installnode dist/scripts/smoke-packed-install.js
sync:pluginnode dist/scripts/sync-plugin-mirror.js
sync:plugin:checknode dist/scripts/sync-plugin-mirror.js --check
testnpm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check
test:ci:compilednpm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check
…and 19 more.

Dependencies3

@iarna/toml^2.2.5
@modelcontextprotocol/sdk^1.26.0
zod^4.3.6