Package evidence
[email protected]
Install-time lifecycle script: postinstall="node scripts/download-grammars.js"
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 4,987Niche · −30% score
- Versions published
- 113
- First published
- Mar 2026
- Publisher
- apmantza
Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Install-time lifecycle script: postinstall="node scripts/download-grammars.js"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 3 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 1 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Install-time lifecycle script | package.json | postinstall="node scripts/download-grammars.js" | 5 |
Manifest
Package metadata
Scripts21
audit:rule-catalognode scripts/validate-rule-catalog.mjsaudit:tree-sitternode scripts/audit-tree-sitter-rules.mjsbuildtsc --project tsconfig.build.jsonbuild:distnode -e "require('fs').rmSync('dist',{recursive:true,force:true})" && tsc --project tsconfig.dist.json --noCheckchecknode scripts/check-extensions.mjscheck:lockfilenode scripts/check-lockfile-sync.mjsdownload-grammarsnode scripts/download-grammars.jsharness:go-pocnode scripts/run-harness.mjs cases/go/pipeline-dispatch-poc --pi-bin "C:\Users\R3LiC\AppData\Roaming\npm\pi.cmd"harness:pocnode scripts/run-harness.mjs cases/ts/pipeline-dispatch-poc --pi-bin "C:\Users\R3LiC\AppData\Roaming\npm\pi.cmd"harness:python-autofix-pocnode scripts/run-harness.mjs cases/python/autofix-default-poc --pi-bin "C:\Users\R3LiC\AppData\Roaming\npm\pi.cmd"harness:python-pocnode scripts/run-harness.mjs cases/python/pipeline-dispatch-poc --pi-bin "C:\Users\R3LiC\AppData\Roaming\npm\pi.cmd"harness:ts-format-pocnode scripts/run-harness.mjs cases/ts/format-default-poc --pi-bin "C:\Users\R3LiC\AppData\Roaming\npm\pi.cmd"linttsc --project tsconfig.jsonlogs:smellsnode scripts/analyze-pi-lens-logs.mjspostinstallnode scripts/download-grammars.jspreparenpm run build:disttestvitest runtest:integrationvitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.tstest:unitvitest run --ignore tests/index-integration.test.ts --ignore tests/clients/lsp/integration.test.tstest:watchvitestwatchtsc --watch
Dependencies7
@ast-grep/napi^0.43.0@earendil-works/pi-tui^0.79.1js-yaml^4.1.1minimatch^10.2.5typebox^1.0.0typescript^6.0.3vscode-jsonrpc^8.2.1
Optional dependencies2
tree-sitter-wasmsnpm:null@^0.11.0web-tree-sitter0.25.10