PkgRadar

Package evidence

[email protected]

Install Lifecycle Suppresses Failure: postinstall="[ -d .git ] && npx husky install || exit 0"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
40
Versions published
36Mature · −50% score
First published
Jul 2021
Publisher
uladkasach

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheruladkasach
Artifact bytes102,566
Previous version0.10.0
Published2024-08-03T16:58:38.939Z
SHA-25697a4b679a57153f99f630ed2756abba2dda482a4958b2ade7f2425de47b2e4d2

Why flagged

What the scanner saw

Install Lifecycle Suppresses Failure: postinstall="[ -d .git ] && npx husky install || exit 0"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
12Score
0.10.1Version
Status history (1 event)
  1. new → available · risk high · score 12 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="[ -d .git ] && npx husky install || exit 0"20
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Suppresses Failurepackage.jsonpostinstall="[ -d .git ] && npx husky install || exit 0"20
lowInstall-time lifecycle scriptpackage.jsonpostinstall="[ -d .git ] && npx husky install || exit 0"5

Manifest

Package metadata

Scripts36
  • buildnpm run build:clean && npm run build:compile
  • build:artifactecho 'no artifact'
  • build:cleanrm dist/ -rf
  • build:compiletsc -p ./tsconfig.build.json
  • build:tstsc -p ./tsconfig.build.json
  • commit:with-clinpx cz
  • fix:formatnpm run fix:format:prettier
  • fix:format:prettierprettier --write '**/*.ts' --config ./prettier.config.js
  • fix:format:terraformecho 'no terraform'
  • fix:linteslint -c ./.eslintrc.js src/**/*.ts --fix
  • generate:cli-readmenpm run build && oclif-dev readme
  • postinstall[ -d .git ] && npx husky install || exit 0
  • postversiongit push origin HEAD --tags --no-verify
  • prepublishnpm run build
  • prepushnpm run test && npm run build
  • preversionnpm run prepush
  • provision:docker:awaitdocker compose -f ./provision/docker/integration_test_db/docker-compose.yml exec -T postgres /root/wait-for-postgres.sh
  • provision:docker:cleardocker rm -f $(docker ps -a -f 'publish=7821' -q) 2>/dev/null || true && echo 'ensured port is available 👍'
  • provision:docker:downdocker compose -f ./provision/docker/integration_test_db/docker-compose.yml down
  • provision:docker:extensionsdocker compose -f ./provision/docker/integration_test_db/docker-compose.yml exec -T postgres /root/provision-extensions.sh
  • provision:docker:updocker compose -f ./provision/docker/integration_test_db/docker-compose.yml up -d --force-recreate --build --renew-anon-volumes
  • provision:integration-test-dbnpm run provision:docker:clear && npm run provision:docker:up && npm run provision:docker:await && npm run provision:docker:extensions
  • testnpm run test:commits && npm run test:types && npm run test:format && npm run test:lint && npm run test:unit && npm run test:integration && npm run test:acceptance:locally
  • test:acceptancenpm run build && jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests
  • test:acceptance:locallynpm run build && LOCALLY=true jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests
  • test:commitsLAST_TAG=$(git describe --tags --abbrev=0 @^ 2> /dev/null || git rev-list --max-parents=0 HEAD) && npx commitlint --from $LAST_TAG --to HEAD --verbose
  • test:formatnpm run test:format:prettier
  • test:format:prettierprettier --parser typescript --check 'src/**/*.ts' --config ./prettier.config.js
  • test:format:terraformecho 'no terraform'
  • test:integrationnpm run test:integration:provision-generated-files-to-import && jest -c ./jest.integration.config.ts --forceExit --verbose --passWithNoTests --runInBand $([ -z $THOROUGH ] && echo '--changedSince=main')
  • …and 6 more.
Dependencies17
  • @ehmpathy/error-fns1.3.1
  • @oclif/core3.26.6
  • @oclif/plugin-help6.0.22
  • chalk2.4.2
  • change-case4.1.1
  • domain-objects0.22.1
  • domain-objects-metadata0.7.4
  • fast-glob3.2.2
  • joi17.4.0
  • lodash.omit4.5.0
  • oclif4.11.3
  • shelljs0.8.5
  • simple-async-tasks1.4.2
  • ts-node10.9.2
  • type-fns1.17.0
  • uuid9.0.0
  • yaml1.6.0