PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: postinstall="node scripts/install-scanners.js"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
44
First published
Mar 2026
Publisher
loxia-labs

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherloxia-labs
Artifact bytes6,783,126
Previous version4.9.8
Published2026-05-31T08:06:44.109Z
SHA-256394f0dbd4413ebba939dadf5f7437b2d9d0135bde16a055a1f4d8dc054bfbbf3

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="node scripts/install-scanners.js"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
4.9.9Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node scripts/install-scanners.js"5

Manifest

Package metadata

Scripts26
  • buildnpm run build:web-ui
  • build:binarypkg . --compress GZip
  • build:binary:linuxpkg . --target node20-linux-x64 --output dist/loxia-linux --compress GZip
  • build:binary:macpkg . --target node20-macos-x64 --output dist/loxia-macos --compress GZip
  • build:binary:winpkg . --target node20-win-x64 --output dist/loxia.exe --compress GZip
  • build:web-uicd web-ui && npm install && npm run build && cd ..
  • devnode --inspect src/index.js
  • docsjsdoc -c jsdoc.config.json
  • electron:buildnpm run build:web-ui && electron-builder
  • electron:build:linuxnpm run build:web-ui && electron-builder --linux
  • electron:build:macnpm run build:web-ui && electron-builder --mac
  • electron:build:onbuzz:linuxcross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --linux -c.productName="Loxia OnBuzz" -c.appId=com.loxia.onbuzz
  • electron:build:onbuzz:maccross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --mac -c.productName="Loxia OnBuzz" -c.appId=com.loxia.onbuzz
  • electron:build:onbuzz:wincross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --win -c.productName="Loxia OnBuzz" -c.appId=com.loxia.onbuzz
  • electron:build:winnpm run build:web-ui && electron-builder --win
  • electron:devcross-env LOXIA_ELECTRON=1 electron electron/main.js
  • electron:dev:onbuzzcross-env LOXIA_ELECTRON=1 LOXIA_BRAND=onbuzz electron electron/main.js
  • generate-readmenode scripts/generate-readme.js
  • linteslint src/
  • postinstallnode scripts/install-scanners.js
  • startnode src/index.js
  • start:terminalnode bin/start-with-terminal.js
  • terminal-uinode bin/loxia-terminal.js
  • terminal-ui-v2node bin/loxia-terminal-v2.js
  • testNODE_OPTIONS='--experimental-vm-modules' jest
  • typecheckecho 'No TypeScript - skipping typecheck'
Dependencies36
  • @babel/parser^7.28.5
  • @babel/traverse^7.28.5
  • blessed^0.1.81
  • blessed-contrib^4.11.0
  • chalk^5.6.2
  • discord.js^14.16.0
  • docx^9.5.3
  • exceljs^4.4.0
  • express^4.18.2
  • ghost-cursor^1.4.2
  • glob^13.0.0
  • http-proxy-middleware^3.0.5
  • ink^5.2.1
  • jsonrepair^3.13.2
  • mammoth^1.11.0
  • node-telegram-bot-api^0.67.0
  • ollama^0.6.3
  • pdf2json^3.1.4
  • postcss^8.5.6
  • postcss-less^6.0.0
  • postcss-scss^4.0.9
  • prettier^3.6.2
  • puppeteer^24.25.0
  • puppeteer-extra^3.3.6
  • puppeteer-extra-plugin-stealth^2.11.2
  • react^18.3.1
  • rimraf^6.0.0
  • sharp^0.33.5
  • sparrow-sast^1.0.1
  • strip-ansi^7.1.2
  • …and 6 more.
Optional dependencies1
  • whatsapp-web.js^1.34.6