Package evidence

[email protected]

Install-time lifecycle script: postinstall="echo '🎉 TaskFlow AI 安装成功！运行 taskflow --help 开始使用'"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 24Established · −30% score
First published: Jul 2025
Publisher: agions

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisheragions

Artifact bytes13,631

Previous version5.0.2

Published2026-05-05T23:34:36.527Z

SHA-2561a7d9638add8445747ecf1aaf1d60cad46150c7cc66e169760ef6ecca1873d12

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="echo '🎉 TaskFlow AI 安装成功！运行 taskflow --help 开始使用'"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

16d agoLast checked

reviewRisk

3Score

5.0.3Version

Status history (1 event)

new → available16d ago · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="echo '🎉 TaskFlow AI 安装成功！运行 taskflow --help 开始使用'"	5

Manifest

Package metadata

Scripts55

benchmarknpm run test:performance
buildnode build.js
build:cleannode build.js --clean
build:fasttsc --skipLibCheck
build:incnode build.js --incremental
build:watchnode build.js --watch
checknpm run type-check && npm run lint && npm run format:check
check:fixnpm run lint:fix && npm run format
cinpm run quality && npm run build
cleanrm -rf dist coverage .nyc_output
clean:allrm -rf dist coverage .nyc_output node_modules docs/node_modules docs/.vitepress/dist
devtsc --watch
docs:buildvitepress build docs
docs:deploybash scripts/deploy-docs.sh
docs:devvitepress dev docs
docs:previewvitepress preview docs
formatprettier --write "src/**/*.{ts,tsx}"
format:checkprettier --check "src/**/*.{ts,tsx}"
linteslint src --ext .ts,.tsx
lint:fixeslint src --ext .ts,.tsx --fix
mcpnode dist/mcp/stdio-server.js
mcp:devnpm run build && node dist/mcp/stdio-server.js
mcp:startnpm run mcp
postinstallecho '🎉 TaskFlow AI 安装成功！运行 taskflow --help 开始使用'
postpackecho 'Package ready for publishing'
prepacknpm run build
prepublishnpm run check
prepublishOnlynpm run quality && npm run build
publish:alphanpm run check && npm version prerelease --preid=alpha && npm publish --tag alpha
publish:betanpm run check && npm version prerelease --preid=beta && npm publish --tag beta
…and 25 more.

Dependencies16

@modelcontextprotocol/sdk1.27.1
axios^1.6.7
boxen^5.1.2
chalk^4.1.2
commander^12.0.0
figlet^1.7.0
fs-extra^11.2.0
gradient-string^2.0.2
handlebars^4.7.8
inquirer^8.2.6
js-yaml^4.1.0
markdown-it^14.1.0
minimatch10.2.4
ora^5.4.1
sql.js^1.14.1
tar^7.5.9

Optional dependencies4

better-sqlite3^11.9.1
mammoth^1.9.0
pdf-parse^1.1.1
sodium-plus^0.9.0