PkgRadar

Package evidence

[email protected]

New Account With Lifecycle Hook: package first published 1 day(s) ago, 4 total version(s), has lifecycle hook

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
4
First published
Jun 2026
Publisher
haimdx

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherhaimdx
Artifact bytes11,813,824
Previous version2.1.1
Published2026-06-17T03:40:07.862Z
SHA-256499472be718c3682b3cb4c500fc62f0de5f38387966e56b71cbdb36ee2cc1170

Why flagged

What the scanner saw

New Account With Lifecycle Hook: package first published 1 day(s) ago, 4 total version(s), has lifecycle hook

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
15Score
2.1.2Version
Status history (1 event)
  1. new → available · risk high · score 15 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highNew Account With Lifecycle Hookpackage.jsonpackage first published 1 day(s) ago, 4 total version(s), has lifecycle hook25
mediumSuspicious Publish Contextmanifest{"package_age_days":1,"publisher":"haimdx","burst_same_day":3,"burst_week":3,"lure":null,"version_anomaly":false,"new_account":false}10
Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
highNew Account With Lifecycle Hookpackage.jsonpackage first published 1 day(s) ago, 4 total version(s), has lifecycle hook25
mediumSuspicious Publish Contextmanifest{"package_age_days":1,"publisher":"haimdx","burst_same_day":3,"burst_week":3,"lure":null,"version_anomaly":false,"new_account":false}10
lowInstall-time lifecycle scriptpackage.jsonpostinstall="npm run sequelize:migrate"5
lowLarge Javascript Payloadpackage/lib/public/dashboard/static/js/2.f7672eec.chunk.js3802190 bytes0

Manifest

Package metadata

Scripts35
  • appium-homerm -rf rm -rf /tmp/tractive-device-farm && export APPIUM_HOME=/tmp/tractive-device-farm
  • buildnpx tsc -b && npm run copy-files
  • build:docsappium-docs build --reference=false
  • buildAndCopyWebsh buildAndCopyWeb.sh
  • clear-cacherm -rf $HOME/.cache/appium-device-farm
  • copy-filescp -R src/public lib
  • coveragenyc npm run test
  • install-docs-depsappium-docs init --no-mkdocs -e lib/index.js
  • install-driver-androidexport APPIUM_HOME=/tmp/tractive-device-farm && appium driver install [email protected]
  • install-driver-iosexport APPIUM_HOME=/tmp/tractive-device-farm && appium driver install [email protected]
  • install-pluginnpm run build && appium plugin install --source=local $(pwd)
  • integration-androidmocha -r ts-node/register ./test/integration/androidDevices.spec.js --timeout 90000 --exit
  • integration-iosmocha -r ts-node/register ./test/integration/*iOS*.spec.js --timeout 260000 --exit
  • linteslint . --ext .ts,.tsx --fix
  • postinstallnpm run sequelize:migrate
  • prepublishnpx tsc && npm run copy-files
  • prettierprettier 'src/**/*.ts' 'web/**/*.ts' 'web/**/*.tsx' --write --single-quote
  • publish:docsappium-docs build --deploy --push -b docs-site -m 'docs: auto-build docs for appium-device-farm@%s' --alias latest
  • reinstall-pluginexport APPIUM_HOME=/tmp/tractive-device-farm && npm run appium-home && (appium plugin uninstall device-farm || exit 0) && npm run install-plugin
  • releasebash publish.sh
  • run-serverexport APPIUM_HOME=/tmp/tractive-device-farm && appium plugin list --installed && appium server -ka 800 --log-timestamp --use-plugins=tractive-device-farm -pa /wd/hub --plugin-tractive-device-farm-platform=both --plugin-tractive-device-farm-auth
  • sequelize:migratesequelize-cli db:migrate
  • sequelize:migrate:undosequelize-cli db:migrate:undo
  • testmocha -r ts-node/register ./test/unit/*.spec.js --plugin-device-farm-platform=both --exit --timeout=10000
  • test-e2ewait-on http://localhost:31337/device-farm/ && mocha --require ts-node/register ./test/e2e/plugin.spec.js --timeout 999999
  • test-e2e-browserstackwait-on http://localhost:31337/device-farm/ && mocha --require ts-node/register ./test/e2e/browserstack.spec.js --timeout 999999
  • test-e2e-pCloudywait-on http://localhost:31337/device-farm/ && mocha --require ts-node/register ./test/e2e/pcloudy.spec.js --timeout 999999
  • test-jestNODE_OPTIONS=--experimental-vm-modules npx jest ./test/unit/AndroidDeviceManager.spec.js
  • test-parallel-androidmocha --require ts-node/register -p ./test/e2e/android/conf.spec.js --timeout 260000
  • test-parallel-bswait-on http://localhost:31337/device-farm/ && mocha --require ts-node/register -p ./test/e2e/android/cloud/conf.spec.js --timeout 260000
  • …and 5 more.
Dependencies64
  • @appium/base-plugin^2.2.22
  • @appium/types^0.14.1
  • @devicefarmer/adbkit^3.2.5
  • @ffmpeg-installer/ffmpeg^1.1.0
  • @types/multer^2.1.0
  • @types/node-persist^3.1.5
  • app-info-parser^1.1.6
  • appium-adb^11.0.3
  • appium-base-driver^7.11.3
  • appium-chromedriver^5.6.19
  • appium-ios-device^2.7.6
  • appium-ios-simulator^4.2.1
  • appium-remote-debugger^9.0.0
  • async-lock^1.2.8
  • async-wait-until^2.0.12
  • asyncbox^3.0.0
  • axios^0.27.2
  • bcryptjs^3.0.3
  • better-sqlite3^11.10.0
  • bluebird^3.7.2
  • body-parser^2.3.0
  • bplist-parser^0.3.2
  • chrome-remote-interface^0.34.0
  • circular-json^0.5.9
  • cors^2.8.5
  • debug^4.4.3
  • download^8.0.0
  • express^4.17.3
  • fs-extra^11.1.1
  • get-port^5.1.1
  • …and 34 more.