PkgRadar

Package evidence

[email protected]

Install Lifecycle Suppresses Failure: preinstall="node scripts/check-node-version.js || exit 0"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
816Established · −30% score
First published
Oct 2025
Publisher
aabyzov

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheraabyzov
Artifact bytes5,203,519
Previous version1.0.586
Published2026-06-02T02:24:27.188Z
SHA-25665f9f2d6162d8b557960433d11e20e80b08b80a25c90dba6db34b9139f6cbe60

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: preinstall="node scripts/check-node-version.js || exit 0"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
49Score
1.0.587Version
Status history (1 event)
  1. new → available · risk high · score 49 · status changed

Evidence

Static findings

7 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpreinstall="node scripts/check-node-version.js || exit 0"20
mediumRemote Payloadpackage/dist/src/core/fabric/discovery/content-fetcher.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/src/sync/projects-v2.jsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/src/cli/commands/update.jsmatched "raw.githubusercontent.com"12
Show all 7 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpreinstall="node scripts/check-node-version.js || exit 0"20
mediumRemote Payloadpackage/dist/src/core/fabric/discovery/content-fetcher.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/src/sync/projects-v2.jsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/src/cli/commands/update.jsmatched "raw.githubusercontent.com"12
lowCredential file accesspackage/dist/src/core/llm/provider-factory.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/src/core/fabric/security-scanner.jsmatched ".ssh/"5
lowInstall-time lifecycle scriptpackage.jsonpreinstall="node scripts/check-node-version.js || exit 0"5

Manifest

Package metadata

Scripts39
  • benchmarkts-node tests/performance/run-all-benchmarks.ts
  • buildtsc && npm run build:dashboard && npm run copy:locales && npm run copy:plugins && npm run copy:hook-deps && npm run copy:adapters
  • build:dashboardnpx vite build --config src/dashboard/client/vite.config.ts
  • cleanrm -rf dist/
  • copy:adaptersnode scripts/build/copy-adapters.js
  • copy:hook-depsnode scripts/build/copy-hook-dependencies.js
  • copy:localesnode scripts/build/copy-locales.js
  • copy:pluginsnode scripts/build/copy-plugin-js.js
  • devtsc --watch
  • generate:diagramsbash scripts/generation/generate-diagram-svgs.sh
  • metrics:doranode dist/src/metrics/dora-calculator.js
  • postversionecho '✅ Version bumped with CHANGELOG entry'
  • preinstallnode scripts/check-node-version.js || exit 0
  • prepublishOnlynpm run rebuild
  • preuninstallnode scripts/preuninstall.cjs
  • rebuildnpm run clean && npm run build
  • releasebash scripts/build/bump-version.sh
  • release:majorbash scripts/build/bump-version.sh major
  • release:minorbash scripts/build/bump-version.sh minor
  • release:patchbash scripts/build/bump-version.sh patch
  • setup:hooksbash scripts/hooks/install-git-hooks.sh
  • testnpm run test:smoke
  • test:allnpm run test:unit && npm run test:integration && npm run test:e2e && npm run test:e2e:lifecycle
  • test:coveragevitest run --coverage
  • test:e2evitest run tests/e2e
  • test:e2e:clivitest run --config vitest.e2e.config.ts
  • test:e2e:dashboardnpx playwright test --config playwright.config.ts
  • test:e2e:debugDEBUG=* vitest run tests/e2e
  • test:e2e:lifecyclevitest run tests/e2e/crash-recovery.e2e.ts
  • test:e2e:watchvitest tests/e2e
  • …and 9 more.
Dependencies17
  • @anthropic-ai/sdk^0.92.0
  • @inquirer/prompts^8.1.0
  • @octokit/rest^22.0.1
  • @types/handlebars^4.0.40
  • axios^1.13.4
  • chalk^5.3.0
  • commander^14.0.2
  • fs-extra^11.3.3
  • glob^13.0.0
  • gray-matter^4.0.3
  • handlebars^4.7.8
  • js-yaml^4.1.0
  • open^11.0.0
  • ora^9.0.0
  • uuid^13.0.0
  • yaml^2.3.4
  • zod^4.1.13