Skip to content

chore: update package.json for canary postinstall test #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pullfrog wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: update package.json for canary postinstall test #50

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"name": "test-repo",
"private": true,
"type": "module",
"name": "test-pkg",
"version": "1.0.0",

@cursor cursor Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Publish guard removed

High Severity

private was dropped while adding a version and renaming the package, so it is now publishable. Combined with the install-time filesystem write in postinstall, a publish would ship a package that mutates the host on install.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.

"scripts": {
"test": "vitest run"
}
"postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt"

@cursor cursor Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Temporary canary postinstall committed

High Severity

The new postinstall script writes a CANARY_MARKER file under /tmp as temporary verification scaffolding. If merged, every install would keep running that side effect and leave canary residue outside the project.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.

},

@cursor cursor Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test script removed

Medium Severity

The test script that ran vitest run was replaced by the canary postinstall, so npm test no longer invokes the existing suite under test/.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.

"dependencies": {}
}