npm @mseep/clawdcursor @1.5.5
score
0.6035
med
flagged
2026-06-22 01:04
amplifiers
co-occurring signal pairs that lift the final score
- install_script_payload + new_install_script: first-ever install script also matches payload regex (+0.15)
Signals fired
| signal | weight | rationale |
|---|---|---|
| content | ||
| new_install_script | 1.0 | first time ['postinstall'] present |
| install_script_payload | 1.0 | install/lifecycle script matches payload regex |
| topology | ||
| mass_publish_burst | 0.8 | publisher 'skydeckai' pushed 26 packages in the last 15min on npm |
| shared_repo_different_publisher | 0.9 | repo 'git+https://github.com/AmrDab/clawdcursor.git' also claimed by 1 package(s) under different publishers: ['npm/clawdcursor'] |
Prior profile (what it deviated from)
{
"had_install_script": false,
"maintainers": [],
"versions": 0
}
Evidence (package doc at flag time)
{
"dependencies_count": 11,
"dist": {
"integrity": "sha512-o1GhJGQ/0n9mFAKDpRPOSkyvEaZjhitG0mt5AQVMI938Y8owwiZBzJcbvpU96Lay8BXg6R8gJtO6DIYwCOVRhA==",
"tarball": "https://registry.npmjs.org/@mseep/clawdcursor/-/clawdcursor-1.5.5.tgz",
"unpackedSize": 3403588
},
"dist-tags": {
"latest": "1.5.5"
},
"latest_version": "1.5.5",
"maintainers": [
{
"email": "support@skydeck.ai",
"name": "skydeckai"
}
],
"num_versions": 1,
"repository": {
"type": "git",
"url": "git+https://github.com/AmrDab/clawdcursor.git"
},
"scripts": {
"build": "tsc && node dist/postbuild.js",
"clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
"dev": "tsx watch src/surface/cli.ts",
"doctor": "node dist/surface/cli.js doctor",
"lint": "eslint src/",
"perf:smoke": "tsx scripts/perf-smoke.ts",
"postbuild:msg": "handled by postbuild.js",
"postinstall": "node scripts/verify-install.js || node -e \"process.exit(0)\" && node scripts/postinstall-native.js || node -e \"process.exit(0)\"",
"prebuild": "npm run clean",
"prepare": "npm run clean && tsc && node dist/postbuild.js",
"setup": "node scripts/verify-install.js && npm run build && node -e \"if(process.platform==='darwin'){const{execSync}=require('child_process');try{execSync('chmod +x native/build.sh && native/build.sh',{stdio:'inherit'})}catch(e){console.error('\\n\u274c Native build failed. Run manually: cd native && ./build.sh');process.exit(1)}}\" && npm link --force",
"start": "node dist/surface/cli.js agent",
"stop": "node dist/surface/cli.js stop",
"sync-version": "tsx scripts/sync-version.ts",
"test": "vitest",
"test:ci": "vitest run",
"test:coverage": "vitest run --coverage",
"test:mcp-schema-snapshot": "tsx scripts/build-mcp-schema.ts",
"test:mcp-schema-snapshot:update": "tsx scripts/build-mcp-schema.ts --write",
"typecheck": "tsc --noEmit",
"typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
"version": "tsx scripts/sync-version.ts && git add SKILL.md docs/index.html docs/install.sh docs/install.ps1"
},
"signal_details": {
"_amplifiers": [
"install_script_payload + new_install_script: first-ever install script also matches payload regex (+0.15)"
],
"install_script_payload": "install/lifecycle script matches payload regex",
"mass_publish_burst": "publisher 'skydeckai' pushed 26 packages in the last 15min on npm",
"new_install_script": "first time ['postinstall'] present",
"shared_repo_different_publisher": "repo 'git+https://github.com/AmrDab/clawdcursor.git' also claimed by 1 package(s) under different publishers: ['npm/clawdcursor']"
},
"time": {
"created": "2026-06-22T06:04:38.688Z",
"modified": "2026-06-22T06:04:39.163Z"
}
}