verify-before-npm-publish

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Uses various standard command-line tools to automate build, validation, and testing workflows.\n
  • Evidence: Use of npm, git, tar, comm, and sort commands in the verification script to manage project state and verify build artifacts.\n- [EXTERNAL_DOWNLOADS]: Interacts with the npm registry to fetch package metadata and download library versions.\n
  • Evidence: Executes npm view to verify version availability and npm pack to download the published version of 'pangu' for file comparison.\n- [DYNAMIC_EXECUTION]: Employs Node.js script execution via CLI flags for configuration management and build verification.\n
  • Evidence: Usage of node -e and node -p to parse and update package.json and verify the exported version from the dist/ directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 11:54 AM