npm lifecycle hooks in the root package.json that execute on install.
Observable signals, stated plainly
Plugin security signals
Every record separates what was actually observed in the source from checks this registry never performs. A record with no findings is not a safety guarantee; it means the static rules found nothing, on one revision.
Why install-time scripts matter most
A Git-sourced package may run preinstall, install, postinstall, prepare, or prepack during installation, outside the agent sandbox and before you review anything. Their presence is reported as a high-severity signal even when the script looks harmless.
What the scanner looks for
Recursive deletes, piping a download straight into a shell, permission widening, privilege escalation.
Reads of SSH keys, .env files, keychains, or environment variables holding tokens and secrets.
eval, the Function constructor, long base64 payloads, and dynamic subprocess execution.
Hardcoded requests to hosts other than GitHub, npm, and other common infrastructure.
Official shared packages declared as regular dependencies instead of peerDependencies, which duplicates the host's copy.
Checks this registry does not run
These are reported as Not run rather than left blank, so an absent result is never mistaken for a passing one.
No package is installed, so no install result is claimed.
No plugin is executed and no behaviour is observed.
Published vulnerability advisories are not independently checked.
One revision, one reading
Each result is bound to a specific commit. A repository can change the moment after it is scanned, and a passing static reading says nothing about behaviour at runtime. Review the source, pin a commit, and install into a disposable profile.