Package evidence

[email protected]

New Account With Lifecycle Hook: package first published 0 day(s) ago, 1 total version(s), has lifecycle hook

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: jweisz3

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherjweisz3

Artifact bytes151,084

Previous versionnone

Published2026-06-11T15:42:14.215Z

SHA-256b1dbe285f887f64b3656225eb771e2b699aa194443073713d32c0343fbecfbb3

Why flagged

What the scanner saw

New Account With Lifecycle Hook: package first published 0 day(s) ago, 1 total version(s), has lifecycle hook

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

1h agoLast checked

highRisk

25Score

3.0.1Version

Status history (1 event)

new → available1h ago · risk high · score 25 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	New Account With Lifecycle Hook	package.json	package first published 0 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="bash scripts/setup-sherpa.sh && chmod +x node_modules/prettier/bin/prettier.cjs \|\| true"	20

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	New Account With Lifecycle Hook	package.json	package first published 0 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="bash scripts/setup-sherpa.sh && chmod +x node_modules/prettier/bin/prettier.cjs \|\| true"	20
low	Install-time lifecycle script	package.json	postinstall="bash scripts/setup-sherpa.sh && chmod +x node_modules/prettier/bin/prettier.cjs \|\| true"	5

Manifest

Package metadata

Scripts29

buildtsc
docstest -d ../tjbot-ce.github.io && typedoc --options typedoc.json || echo 'Skipping docs generation: ../tjbot-ce.github.io not found'
formatprettier --write "src/**/*.{js,ts}" "tests/**/*.{js,ts}"
format:checkprettier --check "src/**/*.{js,ts}" "tests/**/*.{js,ts}"
generate:config-typesnode scripts/generate-config-types.mjs
linteslint .
lint:fixeslint . --fix
markdownlintmarkdownlint "**/*.md" --ignore node_modules
markdownlint:fixmarkdownlint "**/*.md" --ignore node_modules --fix
postbuildcopyfiles -u 1 "src/**/*.{toml,yaml,js}" dist/
postinstallbash scripts/setup-sherpa.sh && chmod +x node_modules/prettier/bin/prettier.cjs || true
prebuildrm -rf dist/* && node scripts/sync-tjbot-config.mjs && npm run generate:config-types
prepacknpm run build
pretestnpm run build
publish-registrynpm publish --access public
publish-registry-dry-runnpm publish --dry-run --access public
sync:config-schemanode scripts/sync-tjbot-config.mjs
testvitest run tests/core
test-cameratsx tests/live/camera.test.ts
test-ledtsx tests/live/led.test.ts
test-microphonetsx tests/live/microphone.test.ts
test-servotsx tests/live/servo.test.ts
test-speakertsx tests/live/speaker.test.ts
test-stttsx tests/live/stt.test.ts
test-ttstsx tests/live/tts.test.ts
test-visiontsx tests/live/vision.test.ts
test:coveragevitest --coverage
update-depsnpx npm-check-updates
upgrade-depsnpx npm-check-updates -u

Dependencies26

@iarna/toml^2.2.5
@inquirer/prompts^8.3.2
ajv^8.20.0
ajv-formats^3.0.1
axios^1.14.0
cli-progress^3.12.0
color-model^0.2.2
fifo^2.4.1
import-meta-resolve^4.2.0
js-easing-functions^1.0.3
js-yaml^4.1.1
lgpio^1.0.6
mic^2.1.2
node-fetch^3.3.2
node-raspistill^2.0.1
onnxruntime-node^1.24.3
pi-camera-connect^0.3.4
pi-spi^1.2.1
rpi-ws281x-native^1.0.4
semaphore^1.1.0
sharp^0.34.5
sherpa-onnx-linux-arm64^1.12.35
sherpa-onnx-node^1.12.35
sleep^6.3.0
temp^0.9.4
winston^3.19.0

Optional dependencies7

@azure/cognitiveservices-computervision^8.2.0
@azure/ms-rest-js^2.7.0
@google-cloud/speech^7.3.0
@google-cloud/text-to-speech^6.4.0
@google-cloud/vision^5.3.5
ibm-watson^12.2.0
microsoft-cognitiveservices-speech-sdk^1.49.0