PkgRadar

Package evidence

[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
105
Versions published
32
First published
May 2026
Publisher
liebenbergb

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherliebenbergb
Artifact bytes1,346,045
Previous version0.6.3
Published2026-05-24T20:05:28.294Z
SHA-256e0b827c2ca667967999ac6665e45ef3c854bec6809c1c96c1762e6d26d9842b2

Why flagged

What the scanner saw

Install Lifecycle Remote Or Exec: postinstall="node -e \"require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
57Score
0.6.4Version
Status history (4 events)
  1. available → available · risk high · score 57 · status available -> available, risk high -> high, score 77 -> 57
  2. available → available · risk high · score 77 · status available -> available, risk high -> high, score 123 -> 77
  3. available → available · risk high · score 123 · status available -> available, risk high -> high, score 345 -> 123
  4. new → available · risk high · score 345 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

liebenbergb

2 members · evidence strength 64
Repeated static TTPstale

Install-time lifecycle script — postinstall="node -e \"require('fs').copyfilesync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""

2 members · evidence strength 70
Repeated static TTPstale

Install Lifecycle Remote Or Exec — postinstall="node -e \"require('fs').copyfilesync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""

2 members · evidence strength 70

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""30
mediumRemote Payloadpackage/start.shmatched "curl "12
Show all 5 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""30
mediumRemote Payloadpackage/start.shmatched "curl "12
lowCredential file accesspackage/dist/learning/promotionGate.jsmatched ".aws/"5
lowMessenger Bot Endpointpackage/dist/integrations/telegram.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node -e \"require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')\""5

Manifest

Package metadata

Scripts54
  • audit:automation-jobsnode scripts/audit-automation-jobs.js
  • audit:triagenode scripts/audit-triage.js
  • autonomyts-node cookbook/task-loop.ts
  • autonomy:debugnode -e "process.env.HARNESS_DEBUG_LOG='.forge-debug.jsonl';require('child_process').spawnSync(process.execPath,[require.resolve('ts-node/dist/bin'),'cookbook/task-loop.ts'],{stdio:'inherit',env:process.env})"
  • autonomy:dryts-node cookbook/task-loop.ts --dry-run
  • autonomy:resetnode -e "['.forge-stop','.forge-state.json'].forEach(f=>{try{require('fs').unlinkSync(f)}catch{}})"
  • autonomy:stopnode -e "require('fs').writeFileSync('.forge-stop','stop')"
  • buildtsc
  • cleanup:automation-jobsnode scripts/cleanup-automation-jobs.js
  • debug:payloadsnode scripts/debug-payload-summary.js
  • devts-node src/cli/index.ts
  • diagnose:gemma-toolnode scripts/lean-gemma-tool-probe.js
  • diagnose:mistralnode scripts/mistral-roundtrip.js
  • helpnode scripts/help.js
  • jarvis:brief-telegramnode scripts/jarvis-brief-telegram.js
  • jarvis:compactnode scripts/jarvis-compact-kg.js
  • jarvis:export-laddernode scripts/jarvis-export-ladder.js
  • jarvis:import-laddernode scripts/jarvis-import-ladder.js
  • jarvis:mcpnode scripts/jarvis-mcp-serve.js
  • jarvis:seednode scripts/jarvis-seed-kg.js
  • linttsc --noEmit
  • postinstallnode -e "require('fs').copyFileSync('node_modules/marked/lib/marked.umd.js','ui/marked.min.js')"
  • prepublishOnlynpm run build
  • release:bumpnode scripts/bump-version.js
  • release:dry-runnode scripts/release-dry-run.js
  • release:manifestnode scripts/release-manifest.js
  • release:notesnode scripts/release-notes.js
  • release:provenancenode scripts/generate-release-provenance.js --write
  • release:readynode scripts/check-release-ready.js
  • servenode dist/web/server.js
  • …and 24 more.
Dependencies13
  • @types/ws^8.18.1
  • discord.js^14.26.4
  • docx^9.6.1
  • exceljs^4.4.0
  • express^5.2.1
  • imapflow^1.3.3
  • marked18.0.3
  • nodemailer^8.0.7
  • ollama^0.5.0
  • pdfjs-dist^5.7.284
  • pdfkit^0.18.0
  • ws^8.20.0
  • yahoo-finance2^3.14.0