Package evidence
[email protected]
Install-time lifecycle script: postinstall="node -e \"try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\""
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Install-time lifecycle script: postinstall="node -e \"try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\""
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (2 events)
- available → available · risk high · score 48 · status available -> available, risk high -> high, score 60 -> 48
- new → available · risk high · score 60 · status changed
Related candidates
Linked campaigns and clusters
thejenildgohel
2 members · evidence strength 56Install-time lifecycle script — postinstall="node -e \"try{require('child_process').execsync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\""
2 members · evidence strength 62Install-time lifecycle script — postinstall="node -e \"try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\""
2 members · evidence strength 62Evidence
Static findings
7 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install-time lifecycle script | package.json | postinstall="node -e \"try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\"" | 30 |
Show all 7 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Install-time lifecycle script | package.json | postinstall="node -e \"try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}\"" | 30 |
| low | Obfuscation | package/bin/_shared.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/scripts/runtime/install-synapse-skill.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/interfaces/cli/ansi.ts | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/interfaces/cli/commands/dashboard.ts | matched "\\u21bb" | 3 |
| low | Obfuscation | package/src/core/engine/memory/utils/formatting.ts | matched "\\u2026" | 3 |
| low | Obfuscation | package/src/interfaces/cli/commands/selftest-checks.ts | matched "\\u2713" | 3 |
Manifest
Package metadata
Scripts37
buildtscbuild:checknpm run quality:typecheckbump:betanode scripts/release/bump-version.mjs --beta && node scripts/release/sync-versions.mjsbump:versionnode scripts/release/bump-version.mjs && node scripts/release/sync-versions.mjscapture-outcomenode scripts/memory/capture-outcome-synapse.mjschecknpm run quality:typecheck && npm run quality:check-scriptsdocs:buildcd docs && jaspr build --dart-define=SITE_BASE_PATH=/synapsedocs:deploynpm run docs:build && firebase deploy --only hosting --config docs/firebase.jsondocs:devcd docs && jaspr servedocs:previewcd docs && jaspr serve --releasedoctortsx scripts/runtime/doctor-synapse.mjsinstall:skillnode scripts/runtime/install-synapse-skill.mjslinteslint . --max-warnings=0postinstallnode -e "try{require('child_process').execSync('node scripts/runtime/install-synapse-skill.mjs --quiet',{stdio:'ignore'})}catch(e){}"prepublishOnlynpm run checkqualitynpm run quality:typecheck && npm run quality:lint && npm run test:coverage && npm run quality:cycles && npm run quality:deps && npm run quality:package && npm run quality:auditquality:auditnode scripts/quality/quality-audit.mjsquality:check-scriptsnode -e "const { execSync } = require('child_process'); const { readdirSync } = require('fs'); const { join } = require('path'); ['bin', 'scripts'].forEach(d => { try { readdirSync(d, { recursive: true }).forEach(f => { if (f.endsWith('.js') || f.endsWith('.cjs') || f.endsWith('.mjs')) { execSync('node --check ' + join(d, f), { stdio: 'inherit' }); } }); } catch (e) {} });"quality:cyclesmadge --circular --extensions js,mjs,ts srcquality:depsdepcheck --json --ignores=publint,tree-sitter-*,ripgrep-binquality:lintnpm run lintquality:packagenode scripts/quality/quality-package.mjsquality:typechecktsc --noEmitrelease:betanpm publish --tag betarelease:checktsx scripts/release/release-exit-criteria.mjsrelease:latestnpm publishsetuptsx scripts/runtime/setup-synapse.mjsstarttsx src/interfaces/app/mcp-server.tsstress:synapsenode scripts/quality/stress-synapse.mjstask-contextnode scripts/memory/task-context-synapse.mjs- …and 7 more.
Dependencies7
@huggingface/transformers^4.2.0@modelcontextprotocol/sdk^1.29.0@vscode/ripgrep^1.17.1ora^9.3.0sqlite-vec^0.1.9tsx^4.22.3zod^4.3.6
Optional dependencies8
tree-sitter^0.25.0tree-sitter-bash^0.25.1tree-sitter-go^0.25.0tree-sitter-javascript^0.25.0tree-sitter-lua^0.21.0tree-sitter-python^0.25.0tree-sitter-rust^0.24.0tree-sitter-typescript^0.23.0