Package evidence

[email protected]

Remote Payload: matched "api.telegram.org/bot"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 10
First published: May 2026
Publisher: waynetaylor

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherwaynetaylor

Artifact bytes811,188

Previous version1.2.1

Published2026-06-02T15:11:02.487Z

SHA-2566895df5e8acc082580e03866b1f57f87427d18c53f0567089235f9a1845f30a9

Why flagged

What the scanner saw

New Lifecycle Script Vs Previous: postinstall added in 1.3.0 vs 1.2.1: "node scripts/postinstall.mjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

21h agoLast checked

highRisk

62Score

1.3.0Version

Status history (1 event)

new → available40h ago · risk high · score 62 · status changed

Evidence

Static findings

3 static · 1 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	New Lifecycle Script Vs Previous	package.json	postinstall added in 1.3.0 vs 1.2.1: "node scripts/postinstall.mjs"	40
medium	Remote Payload	package/dist/core/notify.js	matched "api.telegram.org/bot"	12

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	New Lifecycle Script Vs Previous	package.json	postinstall added in 1.3.0 vs 1.2.1: "node scripts/postinstall.mjs"	40
medium	Remote Payload	package/dist/core/notify.js	matched "api.telegram.org/bot"	12
low	Messenger Bot Endpoint	package/dist/core/notify.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Install-time lifecycle script	package.json	postinstall="node scripts/postinstall.mjs"	5

Manifest

Package metadata

Scripts28

audittsx src/cli.ts
benchvitest bench --run --outputJson=docs/perf-current.json
bench:checktsx scripts/check-perf.ts
bench:updatetsx scripts/check-perf.ts --update-baseline
buildtsc
check:vendor-drifttsx scripts/check-vendor-drift.ts
check:vendor-integritytsx scripts/check-vendor-integrity.ts
cleanrm -rf dist sbom.json docs/api
docs:apitypedoc
license:checklicense-checker --production --onlyAllow "MIT;Apache-2.0;ISC;BSD-2-Clause;BSD-3-Clause;BSD;MPL-2.0;LGPL-3.0-or-later;Unlicense;CC-BY-3.0;CC-BY-4.0;CC0-1.0;0BSD;Apache*;(MIT OR WTFPL);(AFL-2.1 OR BSD-3-Clause);(BSD-2-Clause OR MIT OR Apache-2.0)"
license:csvlicense-checker --production --csv --out docs/third-party-licenses.csv
linteslint src
lint:no-consoletsx scripts/check-no-console.ts
measure:memorynode --expose-gc --import tsx scripts/measure-memory.ts
postinstallnode scripts/postinstall.mjs
prepublishOnlynpm run build && npm test
sbomcyclonedx-npm --output-file sbom.json --omit dev --ignore-npm-errors
schemastsx scripts/export-result-schemas.ts
sync:vendorbash scripts/sync-vendor.sh
testnpm run lint:no-console && vitest run
test:coveragevitest run --coverage
test:coverage:checkvitest run --coverage --coverage.thresholdAutoUpdate=false
test:e2e:recordAUDIT_E2E_RECORD=1 vitest run tests/integration/llm-cassettes.test.ts --no-file-parallelism
test:e2e:replayAUDIT_E2E_REPLAY=1 vitest run tests/integration/llm-cassettes.test.ts --no-file-parallelism
test:integrationvitest run --config vitest.integration.config.ts
test:integration:playwrightplaywright test
test:watchvitest
typechecktsc --noEmit

Dependencies19

@anthropic-ai/sdk^0.94.0
@browserbasehq/stagehand^3.3.0
@modelcontextprotocol/sdk^1.29.0
axe-core^4.11.4
better-sqlite3^12.9.0
chalk^5.3.0
commander^14.0.3
dotenv^17.4.2
odiff-bin^4.3.8
ora^9.4.0
p-limit^7.3.0
pino^10.3.1
pino-pretty^13.1.3
playwright^1.49.0
playwright-core^1.49.0
sharp^0.34.5
ws^8.20.0
yaml^2.6.0
zod^3.25.76