PkgRadar

Package evidence

[email protected]

New Account With Lifecycle Hook: package first published 4 day(s) ago, 6 total version(s), has lifecycle hook

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
6
First published
Jun 2026
Publisher
jetienne

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherjetienne
Artifact bytes108,143
Previous version1.0.6
Published2026-06-08T16:15:57.146Z
SHA-256bd4589b2b146ed26f986cb2949e6e8d7743cb98f9c09accea43ed8ea06d30da7

Why flagged

What the scanner saw

New Lifecycle Script Vs Previous: postinstall added in 1.0.8 vs 1.0.6: "sh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
45Score
1.0.8Version
Status history (1 event)
  1. new → available · risk high · score 45 · status changed

Evidence

Static findings

2 static · 1 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 1.0.8 vs 1.0.6: "sh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh"40
mediumNew Account With Lifecycle Hookpackage.jsonpackage first published 4 day(s) ago, 6 total version(s), has lifecycle hook10
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previouspackage.jsonpostinstall added in 1.0.8 vs 1.0.6: "sh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh"40
mediumNew Account With Lifecycle Hookpackage.jsonpackage first published 4 day(s) ago, 6 total version(s), has lifecycle hook10
lowInstall-time lifecycle scriptpackage.jsonpostinstall="sh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh"5

Manifest

Package metadata

Scripts28
  • buildtsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json --resolve-full-paths
  • cleanrm -rf dist
  • clean:allnpm run dev:cost:clear && npm run openai_cache:clean
  • dev:chat:bluesky_social_managertsx ./src/cli.ts chat -c ./data/skillets/bluesky_social_manager.skilled_crew.yaml
  • dev:chat:business_analysttsx ./src/cli.ts chat -c ./data/skillets/business_analyst.skilled_crew.yaml
  • dev:chat:multi_bluesky_agenttsx ./src/cli.ts chat -c ./data/skillets/multi_bluesky_agent/multi_bluesky_agent.skilled_crew.yaml
  • dev:chat:todo_listtsx ./src/cli.ts chat -c ./data/skillets/todo_list.skilled_crew.yaml
  • dev:chat:web_browsertsx ./src/cli.ts chat -c ./data/skillets/web_browser.skilled_crew.yaml
  • dev:cost:clearrm -f ../../.skilled-agent/state/.openai_cost_tracker.sqlite
  • dev:cost:listnpx --package=openai-cost openai_cost_pp -p '{namespace}/{userId}/{skilletId}/{sessionId}' -k userId,skilletId -i ../../.skilled-agent/state/.openai_cost_tracker.sqlite
  • dev:cost:list:watchnpx --package=openai-cost openai_cost_pp -p '{namespace}/{userId}/{skilletId}/{sessionId}' -k userId,skilletId -i ../../.skilled-agent/state/.openai_cost_tracker.sqlite -w
  • dev:eval:grade:blueskytsx ./src/cli.ts eval_grade -f ./data/skillets/evals/bluesky_evals
  • dev:eval:run:blueskytsx ./src/cli.ts eval_run -c ./data/skillets/bluesky_social_manager.skilled_crew.yaml -f ./data/skillets/evals/bluesky_evals
  • dev:log:streamtsx ./src/cli.ts log stream
  • dev:run:todo_listtsx ./src/cli.ts run -c ./data/skillets/todo_list.skilled_crew.yaml 'what are my tasks?'
  • openai_cache:cleanrm -f ../../.skilled-agent/cache/.openai_cache.sqlite
  • postbuildchmod +x ./dist/cli.js
  • postinstallsh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh
  • prepublishOnlynpm run test && npm run clean && npm run build
  • publish:allnpm run build && npm version patch && npm publish --access public
  • schema:checktsx ./src/cli.ts schema_check
  • schema:generatetsx ./src/cli.ts schema_generate
  • testtsx --test 'tests/**/*.test.ts'
  • test:allnpm run typecheck && npm test
  • test:coveragetsx --test --experimental-test-coverage 'tests/**/*.test.ts'
  • test:fallownpx --yes fallow audit
  • test:watchtsx --test --watch 'tests/**/*.test.ts'
  • typechecktsc --noEmit
Dependencies17
  • @keyv/sqlite^4.0.8
  • @openai/agents^0.8.2
  • @openai/agents-core^0.8.3
  • bcrypt^6.0.0
  • better-sqlite3^12.8.0
  • cacheable^2.3.3
  • chalk^5.6.2
  • commander^14.0.3
  • dotenv^17.3.1
  • gray-matter^4.0.3
  • openai^6.33.0
  • openai-cache^1.0.37
  • openai-cost^1.0.32
  • remark^15.0.1
  • uuid^11.0.0
  • yaml^2.8.3
  • zod^4.0.0