Package evidence

[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 627
Versions published: 342
First published: Feb 2026
Publisher: djtony707

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherdjtony707

Artifact bytes5,737,011

Previous version6.4.0

Published2026-05-22T20:16:22.658Z

SHA-2563606a10ccaa7208c0c982a62bea0a391bb0c02add931cd075db74843478ad96d

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

8h agoLast checked

highRisk

84Score

6.4.1Version

Status history (1 event)

new → available8h ago · risk high · score 84 · status changed

Evidence

Static findings

13 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\""	30
medium	Remote Payload	package/dist/skills/marketplace.js	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/dist/cli/onboard.js	matched "api.telegram.org/bot"	12

Show all 13 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Install Lifecycle Remote Or Exec	package.json	postinstall="node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\""	30
medium	Remote Payload	package/dist/skills/marketplace.js	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/dist/cli/onboard.js	matched "api.telegram.org/bot"	12
low	Credential file access	package/dist/security/exfilScan.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/dist/skills/builtin/filesystem.js	matched "id_rsa"	5
low	Messenger Bot Endpoint	package/dist/cli/onboard.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Credential file access	package/dist/security/secretGuard.js	matched "aws_access_key"	5
low	Credential file access	package/dist/agent/stagingScanners.js	matched "AWS_ACCESS_KEY"	5
low	Install-time lifecycle script	package.json	postinstall="node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\""	5
low	Large Javascript Payload	package/ui/dist/babel.min.js	3137678 bytes	0
low	Obfuscation Density	package/dist/gateway/dashboard.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/eval/gaia-harness.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cli/onboard.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts38

bench:gaiatsx scripts/benchmark/gaia.ts
bench:swetsx scripts/benchmark/swe-bench.ts
benchmarktsx scripts/benchmark.ts
benchmark:drytsx scripts/benchmark.ts --dry-run
buildtsup
build:personalnode scripts/build-personal.cjs
build:uicd ui && npm install && npm run build
cinpm run typecheck && npm run test
devtsx src/cli/index.ts
dev:debugTITAN_LOG_LEVEL=debug tsx src/cli/index.ts gateway -v
dev:doctortsx src/cli/index.ts doctor
dev:gatewaytsx src/cli/index.ts gateway
dev:onboardtsx src/cli/index.ts onboard
doctortsx src/cli/index.ts doctor
evaltsx scripts/agent-eval-v2.ts
eval:jsontsx scripts/agent-eval-v2.ts --json
eval:recordtsx scripts/eval-record.ts
eval:verbosetsx scripts/agent-eval-v2.ts --verbose
gatewaytsx src/cli/index.ts gateway
gitnexus:querynode /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js query
gitnexus:rebuildnode /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js analyze --name TITAN
gitnexus:statusnode /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js status
linteslint src/ --ext .ts
lint:fixeslint src/ --ext .ts --fix
onboardtsx src/cli/index.ts onboard
postinstallnode -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}"
startnode dist/cli/index.js
testvitest run --reporter=basic
test:coveragevitest run --coverage
test:e2enpx playwright test
…and 8 more.

Dependencies17

@inquirer/prompts^8.4.3
@langchain/core^1.1.46
@mozilla/readability^0.6.0
boxen^8.0.1
chalk^5.3.0
commander^14.0.3
dotenv^17.4.2
express^4.22.2
jsdom^29.1.1
node-cron^4.2.1
ora^9.4.0
posthog-node^5.34.2
turndown^7.2.2
undici^8.2.0
uuid^14.0.0
ws^8.20.1
zod^3.23.8

Optional dependencies9

@browserbasehq/stagehand^3.4.0
@whiskeysockets/baileys^6.7.0
bonjour-service^1.3.0
imapflow^1.3.3
livekit-server-sdk^2.9.1
matrix-js-sdk^41.5.0
node-llama-cpp^3.0.0
pdf-parse^2.4.5
playwright^1.58.2