PkgRadar

Package evidence

[email protected]

Install-time lifecycle script: preinstall="node scripts/enforce-package-manager.cjs"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
69Established · −30% score
First published
Oct 2025
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
PublisherGitHub Actions
Artifact bytes560,744
Previous version0.30.0
Published2026-06-02T23:21:20.873Z
SHA-2563669f8df00db6a49ac3f949b65ba55923fca102a9db68cc2f1e5f5add12476d3

Why flagged

What the scanner saw

New Lifecycle Script Vs Previous: postinstall added in 0.31.0 vs 0.30.0: "node scripts/check-cli-resolution.cjs"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
50Score
0.31.0Version
Status history (1 event)
  1. new → available · risk high · score 50 · status changed

Evidence

Static findings

2 static · 1 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 0.31.0 vs 0.30.0: "node scripts/check-cli-resolution.cjs"40
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 0.31.0 vs 0.30.0: "node scripts/check-cli-resolution.cjs"40
lowInstall-time lifecycle scriptpackage.jsonpreinstall="node scripts/enforce-package-manager.cjs"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node scripts/check-cli-resolution.cjs"5

Manifest

Package metadata

Scripts53
  • act-matrixact -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P macos-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P windows-latest=ghcr.io/catthehacker/ubuntu:act-22.04 --pull=false -j build-test-matrix
  • analyzenpm run build && node scripts/analyze-dist.mjs
  • benchnpx tsx scripts/benchmarks.ts
  • buildtsup
  • build:watchtsup --watch
  • bundle-sizenpm run build && du -sh dist/ && ls -lh dist/
  • check:contractsnode scripts/sync-contracts.mjs --check
  • check:docs-driftnode scripts/docs-drift-guard.mjs
  • check:markdown-linksnode scripts/check-markdown-links.mjs
  • check:parity-snapshotnode scripts/sync-import-stack-parity-snapshot.mjs --check
  • devtsup --watch
  • dev:localnpm run build && npm link
  • formatprettier --write "src/**/*.ts"
  • format:checkprettier --check "src/**/*.ts"
  • generate-embeddingsnpx tsx src/ai/generate-embeddings.ts
  • install:localnpm unlink -g rapidkit && npm run build && npm link
  • linteslint src --ext .ts
  • lint:fixeslint src --ext .ts --fix
  • metricsnpx tsx scripts/metrics.ts
  • postinstallnode scripts/check-cli-resolution.cjs
  • preinstallnode scripts/enforce-package-manager.cjs
  • prepacknpm run build && npm run test:prepare-embeddings && npm run verify:package-cli
  • preparehusky
  • qualitynpm run typecheck && npm run lint && npm run format:check && npm test && npm run size-check
  • release:drybash scripts/release.sh --no-publish --yes --allow-dirty
  • release:majorbash scripts/release.sh major
  • release:minorbash scripts/release.sh minor
  • release:patchbash scripts/release.sh patch
  • securitynpm audit --audit-level=moderate
  • security:fixnpm audit fix
  • …and 23 more.
Dependencies10
  • chalk^5.3.0
  • cli-progress^3.12.0
  • commander^12.1.0
  • execa^9.3.1
  • fs-extra^11.2.0
  • inquirer^13.2.2
  • nunjucks^3.2.4
  • openai^6.22.0
  • ora^8.0.1
  • validate-npm-package-name^5.0.1
Optional dependencies1
  • @rollup/rollup-win32-x64-msvc*