PkgRadar

Package evidence

[email protected]

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
10
Versions published
37Established · −30% score
First published
Sep 2025
Publisher
verifiedx

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherverifiedx
Artifact bytes3,026,197
Previous version2.0.12
Published2025-11-13T03:24:17.957Z
SHA-256bbff1089b19d00546de63b0788e65cdf5456b98603e263ab823505f06f87cd1d

Why flagged

What the scanner saw

Install Lifecycle Remote Or Exec: postinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
24Score
2.0.13Version
Status history (1 event)
  1. new → available · risk high · score 24 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""30
Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""30
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node -e \"const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \\\"'use strict';\\\\n\\\\n/** @type {import('./round')} */\\\\nmodule.exports = Math.round;\\\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \\\"export = round;\\\\ndeclare function round(x: number): number;\\\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\\\('\\\\.\\\\/([^']+)'\\\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\\\\\"number\\\\\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }\""5
lowLarge Javascript Payloadpackage/lib/browser.js2007304 bytes0
lowLarge Javascript Payloadpackage/lib/browser.umd.js2022734 bytes0

Manifest

Package metadata

Scripts17
  • apply-browser-fixescp ./resources/cipher-fix.js ./lib/cipher-fix.js
  • buildnpm run build:cjs && npm run build:esm && npm run build:browser && npm run build:browser-optimized && npm run apply-browser-fixes
  • build:browser./node_modules/.bin/esbuild src/browser/index.ts --bundle --sourcemap=external --format=iife --global-name=VfxSDK --outfile=lib/browser.js --platform=browser --alias:stream=readable-stream
  • build:browser-optimizednode esbuild.browser.js
  • build:cjstsc -p tsconfig.cjs.json
  • build:esmtsc -p tsconfig.esm.json && npm run fix-esm-extensions && echo '{"type":"module"}' > lib/esm/package.json
  • fix-esm-extensionsnode scripts/fix-esm-extensions.js
  • formatprettier --write "src/**/*.(js|ts)"
  • linteslint src --ext .js,.ts
  • lint:fixeslint src --fix --ext .js,.ts
  • postinstallnode -e "const fs = require('fs'); const path = require('path'); try { const dirs = ['./node_modules/math-intrinsics', './node_modules/get-intrinsic/node_modules/math-intrinsics']; dirs.forEach(dir => { if (!fs.existsSync(dir)) return; const roundFile = path.join(dir, 'round.js'); if (!fs.existsSync(roundFile)) { fs.writeFileSync(roundFile, \"'use strict';\\n\\n/** @type {import('./round')} */\\nmodule.exports = Math.round;\"); } const roundDts = path.join(dir, 'round.d.ts'); if (!fs.existsSync(roundDts)) { fs.writeFileSync(roundDts, \"export = round;\\ndeclare function round(x: number): number;\"); } const pkgFile = path.join(dir, 'package.json'); if (fs.existsSync(pkgFile)) { const pkg = JSON.parse(fs.readFileSync(pkgFile, 'utf8')); if (pkg.exports && !pkg.exports['./round']) { pkg.exports['./round'] = './round.js'; fs.writeFileSync(pkgFile, JSON.stringify(pkg, null, '\\t')); } } const jsFiles = fs.readdirSync(dir).filter(f => f.endsWith('.js')).map(f => path.join(dir, f)); jsFiles.forEach(file => { if (fs.existsSync(file)) { const content = fs.readFileSync(file, 'utf8'); const fixed = content.replace(/require\\('\\.\\/([^']+)'\\)/g, (match, mod) => { if (['isNaN', 'abs', 'floor', 'isFinite'].includes(mod)) { const replacements = { isNaN: 'Number.isNaN || function isNaN(a) { return a !== a; }', abs: 'Math.abs', floor: 'Math.floor', isFinite: 'Number.isFinite || function isFinite(x) { return typeof x === \\\"number\\\" && !isNaN(x) && x !== Infinity && x !== -Infinity; }' }; return replacements[mod] || match; } return match; }); if (fixed !== content) fs.writeFileSync(file, fixed); } }); }); } catch (e) { console.warn('postinstall math-intrinsics fix failed:', e.message); }"
  • postversiongit push && git push --tags
  • preparenpm run build
  • prepublishOnlynpm test && npm run lint && npm run build
  • preversionnpm run lint
  • testjest --config jest.config.js --silent='false'
  • versionnpm run format && git add -A src
Dependencies16
  • @bitcoinerlab/secp256k1^1.2.0
  • @noble/hashes^1.8.0
  • @noble/secp256k1^3.0.0
  • bip32^4.0.0
  • bip393.0.2
  • bitcoinjs-lib^6.1.7
  • browser-crypto^2.0.0
  • bs58^5.0.0
  • crypto-js^3.1.9-1
  • ecpair^2.1.0
  • elliptic^6.5.4
  • hdkey^2.1.0
  • readable-stream^4.7.0
  • regtest-client^0.2.1
  • secp256k1^5.0.0
  • tiny-secp256k11.1.6