Package evidence

[email protected]

New Account With Lifecycle Hook: package first published 4 day(s) ago, 7 total version(s), has lifecycle hook

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 7
First published: Jun 2026
Publisher: jetienne

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherjetienne

Artifact bytes182,097

Previous version1.0.8

Published2026-06-08T17:01:59.384Z

SHA-25652edf8dda8f6998f75efdf5c5d4c2d763690bbb61719b9f135d6577aa7186688

Why flagged

What the scanner saw

New Account With Lifecycle Hook: package first published 4 day(s) ago, 7 total version(s), has lifecycle hook

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

13h agoLast checked

reviewRisk

5Score

1.0.9Version

Status history (1 event)

new → available13h ago · risk review · score 5 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	New Account With Lifecycle Hook	package.json	package first published 4 day(s) ago, 7 total version(s), has lifecycle hook	10

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	New Account With Lifecycle Hook	package.json	package first published 4 day(s) ago, 7 total version(s), has lifecycle hook	10
low	Install-time lifecycle script	package.json	postinstall="sh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh"	5
low	Obfuscation Density	package/data/dotclaude_business_analyst/package-lock.json	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts28

buildtsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json --resolve-full-paths
cleanrm -rf dist
clean:allnpm run dev:cost:clear && npm run openai_cache:clean
dev:chat:bluesky_social_managertsx ./src/cli.ts chat -c ./data/skillets/bluesky_social_manager.skilled_crew.yaml
dev:chat:business_analysttsx ./src/cli.ts chat -c ./data/skillets/business_analyst.skilled_crew.yaml
dev:chat:multi_bluesky_agenttsx ./src/cli.ts chat -c ./data/skillets/multi_bluesky_agent/multi_bluesky_agent.skilled_crew.yaml
dev:chat:todo_listtsx ./src/cli.ts chat -c ./data/skillets/todo_list.skilled_crew.yaml
dev:chat:web_browsertsx ./src/cli.ts chat -c ./data/skillets/web_browser.skilled_crew.yaml
dev:cost:clearrm -f ../../.skilled-agent/state/.openai_cost_tracker.sqlite
dev:cost:listnpx --package=openai-cost openai_cost_pp -p '{namespace}/{userId}/{skilletId}/{sessionId}' -k userId,skilletId -i ../../.skilled-agent/state/.openai_cost_tracker.sqlite
dev:cost:list:watchnpx --package=openai-cost openai_cost_pp -p '{namespace}/{userId}/{skilletId}/{sessionId}' -k userId,skilletId -i ../../.skilled-agent/state/.openai_cost_tracker.sqlite -w
dev:eval:grade:blueskytsx ./src/cli.ts eval_grade -f ./data/skillets/evals/bluesky_evals
dev:eval:run:blueskytsx ./src/cli.ts eval_run -c ./data/skillets/bluesky_social_manager.skilled_crew.yaml -f ./data/skillets/evals/bluesky_evals
dev:log:streamtsx ./src/cli.ts log stream
dev:run:todo_listtsx ./src/cli.ts run -c ./data/skillets/todo_list.skilled_crew.yaml 'what are my tasks?'
openai_cache:cleanrm -f ../../.skilled-agent/cache/.openai_cache.sqlite
postbuildchmod +x ./dist/cli.js
postinstallsh ./scripts/install_data_subprojects.sh && sh ./scripts/seed_default_user.sh
prepublishOnlynpm run test && npm run clean && npm run build
publish:allnpm run build && npm version patch && npm publish --access public
schema:checktsx ./src/cli.ts schema_check
schema:generatetsx ./src/cli.ts schema_generate
testtsx --test 'tests/**/*.test.ts'
test:allnpm run typecheck && npm test
test:coveragetsx --test --experimental-test-coverage 'tests/**/*.test.ts'
test:fallownpx --yes fallow audit
test:watchtsx --test --watch 'tests/**/*.test.ts'
typechecktsc --noEmit

Dependencies17

@keyv/sqlite^4.0.8
@openai/agents^0.8.2
@openai/agents-core^0.8.3
bcrypt^6.0.0
better-sqlite3^12.8.0
cacheable^2.3.3
chalk^5.6.2
commander^14.0.3
dotenv^17.3.1
gray-matter^4.0.3
openai^6.33.0
openai-cache^1.0.37
openai-cost^1.0.32
remark^15.0.1
uuid^11.0.0
yaml^2.8.3
zod^4.0.0