Package evidence
[email protected]
Install Lifecycle Suppresses Failure: postinstall="node install.cjs || true"
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 49
- First published
- Mar 2026
- Publisher
- quanyunkeji
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Install Lifecycle Suppresses Failure: postinstall="node install.cjs || true"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (4 events)
- available → available · risk high · score 25 · status available -> available, risk high -> high, score 17 -> 25
- available → available · risk high · score 17 · status available -> available, risk high -> high, score 25 -> 17
- available → available · risk high · score 25 · status available -> available, risk high -> high, score 17 -> 25
- new → available · risk high · score 17 · status changed
Evidence
Static findings
2 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install Lifecycle Suppresses Failure | package.json | postinstall="node install.cjs || true" | 20 |
Show all 2 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install Lifecycle Suppresses Failure | package.json | postinstall="node install.cjs || true" | 20 |
| low | Install-time lifecycle script | package.json | postinstall="node install.cjs || true" | 5 |
Manifest
Package metadata
Scripts73
benchmark:typed-part-baselinebun scripts/typed-part-baseline-benchmark.mjsbuildnpm run build:npmbuild:binarybun scripts/build-binary.mjsbuild:native-locknode scripts/build-native-lock.mjsbuild:npmbun scripts/build.mjsbuild:runtime-auditbun scripts/build-runtime-audit-binary.mjsbuild:runtime-packagebun scripts/build-runtime-package.mjsbuild:sdknpm --prefix ./packages/sdk run buildcheck:compat-windownode scripts/sdk-compat-window-gate.mjscheck:docs-consistencynode scripts/sdk-docs-consistency-gate.mjscheck:facade-closeoutnode scripts/sdk-facade-closeout-gate.mjscheck:legacy-usagenode scripts/sdk-legacy-usage-gate.mjscheck:legacy-windownode scripts/sdk-legacy-window-gate.mjscheck:major-cutovernode scripts/sdk-major-cutover-gate.mjscheck:sdk-consistencynode scripts/sdk-consistency-gate.mjscheck:sdk-contract-consistencynode scripts/sdk-contract-consistency-gate.mjscheck:sdk-generatednode scripts/sdk-check-generated.mjscheck:sdk-legacy-semanticsnode scripts/sdk-legacy-semantics-gate.mjscleannode scripts/clean.mjsdevbun run ./src/entrypoints/cli.tsx --verbosedev:serverbun --eval "import { startServer } from './src/server/index.ts'; await startServer({ port: 4096 }); await new Promise(() => {});"enforce:typed-compat-retirementnode scripts/typed-compat-retirement-enforce.mjsformatprettier --write "src/**/*.{ts,tsx,js,jsx,json}" "tests/**/*.{ts,tsx,js,jsx,json}"format:checkprettier --check "src/**/*.{ts,tsx,js,jsx,json}" "tests/**/*.{ts,tsx,js,jsx,json}"gate:lsp-a0-baselinenode scripts/lsp-a0-baseline-gate.mjs --samples-file tests/fixtures/lsp/a0-baseline-samples.json --min-total 120 --min-per-operation 30gate:lsp-a2prime-behavior-invariantnode scripts/lsp-a2prime-behavior-invariant-gate.mjs --mode rungate:lsp-semantic-unknown-rationode scripts/lsp-semantic-unknown-ratio-gate.mjsgate:model-platform-closeoutnode scripts/model-platform-closeout-gate.mjsgate:protected-tool-namesnode scripts/protected-tool-names-gate.mjsgate:query-adapter-boundarynode scripts/query-adapter-boundary-gate.mjs- …and 43 more.
Dependencies65
@anthropic-ai/bedrock-sdk^0.12.6@anthropic-ai/sdk^0.39.0@anthropic-ai/vertex-sdk^0.7.0@astrojs/language-server2.16.2@aws-sdk/client-bedrock-runtime3.797.0@commander-js/extra-typings^13.1.0@inkjs/ui^2.0.0@modelcontextprotocol/sdk^1.15.1@prisma/language-server31.3.4@types/lodash-es^4.17.12@types/react^19.1.8@vscode/ripgrep^1.17.0@vue/language-server3.2.2ajv^8.17.1ansi-escapes^7.0.0bash-language-server5.6.0chalk^5.4.1cli-highlight^2.1.11cli-table3^0.6.5commander^13.1.0debug^4.4.1diff^7.0.0dockerfile-language-server-nodejs0.15.0dotenv^16.6.1env-paths^3.0.0fflate^0.8.2figures^6.1.0glob^11.0.3graphql-language-service-cli3.5.0gray-matter^4.0.3- …and 35 more.
Optional dependencies8
pyb-runtime-darwin-arm641.5.84pyb-runtime-darwin-x641.5.84pyb-runtime-linux-arm64-gnu1.5.84pyb-runtime-linux-armv7-gnueabihf1.5.84pyb-runtime-linux-x64-gnu1.5.84pyb-runtime-linux-x64-musl1.5.84pyb-runtime-win32-arm64-msvc1.5.84pyb-runtime-win32-x64-msvc1.5.84