Package evidence

[email protected]

Install-time lifecycle script: postinstall="patch-package"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 276
Versions published: 132Mature · −50% score
First published: Nov 2023
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes1,986,940

Previous version11.17.0

Published2026-05-18T14:41:54.031Z

SHA-25610fb4c446b981156916d396a488d1ca370a23930a75aa17a30467d28a119336a

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="patch-package"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

21d agoLast checked

reviewRisk

1Score

11.18.0Version

Status history (1 event)

new → available21d ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="patch-package"	5

Manifest

Package metadata

Scripts33

browserchromium-browser --user-data-dir=/tmp/zui-data --ignore-certificate-errors --unsafely-treat-insecure-origin-as-secure=https://localhost:8092 https://localhost:8092
buildnpm-run-all build:*
build:servertsc
build:uivite build
bundlenode esbuild.js
changelogconventional-changelog -p angular -i CHANGELOG.md -s && git add CHANGELOG.md
changelog-initconventional-changelog -p angular -i CHANGELOG.md -s -r 0
cleantsc --build --clean
coveragec8 --clean npm run test
devvite
dev-httpsSERVER_SSL='true' npm run dev
dev:servernodemon
docker:builddocker build -f docker/Dockerfile -t zwavejs/zwave-js-ui:latest .
docker:rundocker run -p 8092:8092 zwavejs/zwave-js-ui:latest
docsdocsify serve ./docs
docs:generatenode --experimental-strip-types generateDocs.ts
fake-sticknpx mock-server -- -c server_config.js
generate-pwa-assetsnpx @vite-pwa/assets-generator --preset minimal public/logo.svg
lintnpm-run-all 'lint:*'
lint-fixnpm-run-all 'lint-fix:*'
lint-fix:eslinteslint --fix
lint-fix:markdownlintmarkdownlint --fix '**/*.md'
lint:eslinteslint
lint:markdownlintmarkdownlint '**/*.md'
pkgchmod +x package.sh && ./package.sh
postinstallpatch-package
record-coveragec8 report --reporter=text-lcov --all --exclude='test/*' --exclude=.git --exclude=.eslintrc.js --exclude=.postcssrc.js --exclude=wallaby.js > ./coverage/lcov.info
releaseread -p 'GITHUB_TOKEN: ' GITHUB_TOKEN && export GITHUB_TOKEN=$GITHUB_TOKEN && release-it
servernode --experimental-strip-types api/bin/www.ts
startnode --preserve-symlinks server/bin/www.js
…and 3 more.

Dependencies31

@esm2cjs/escape-string-regexp^5.0.0
@kvaster/zwavejs-prom^0.0.3
@zwave-js/log-transport-json^3.0.0
@zwave-js/server^3.8.0
archiver^7.0.1
compression^1.8.1
connect-history-api-fallback2.0.0
cookie-parser^1.4.6
cors^2.8.5
croner^8.0.2
dotenv^16.4.5
express^4.19.2
express-rate-limit^7.3.1
express-session^1.18.0
extract-zip^2.0.1
jsonfile^6.1.0
jsonwebtoken^9.0.2
merge^2.1.1
morgan~1.10.0
mqtt^5.7.2
mqtt-jsonl-store^0.3.1
multer^2.0.2
native-url^0.3.4
patch-package^8.0.1
selfsigned^2.4.1
semver^7.6.2
session-file-store^1.5.0
socket.io^4.7.5
winston^3.13.0
winston-daily-rotate-file^5.0.0
…and 1 more.