chore: update package.json for canary test#12
Conversation
…n' into pullfrog/canary-test-package-json
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fc0783d. Configure here.
| "scripts": { | ||
| "test": "vitest run" | ||
| } | ||
| "postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt" |
There was a problem hiding this comment.
Test artifact postinstall script committed to repository
High Severity
A postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt is being committed. This will execute on every npm install for all contributors, writing to the filesystem as a side effect. This is a canary-test artifact that doesn't belong in the committed package.json. It also replaces the "test": "vitest run" script, so npm test no longer works despite test files (test/math.test.ts using vitest) still existing in the repo.
Reviewed by Cursor Bugbot for commit fc0783d. Configure here.
| } | ||
| "postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt" | ||
| }, | ||
| "dependencies": {} |
There was a problem hiding this comment.
Removal of private: true risks accidental publication
Medium Severity
The "private": true field was removed as part of the canary test changes. This fixture/test repository (per the README) is not intended for npm publication, and without private: true, an accidental npm publish would succeed. The "type": "module" field was also removed, which could affect module resolution for the existing TypeScript source files that use ES module syntax.
Reviewed by Cursor Bugbot for commit fc0783d. Configure here.


This PR captures the
package.jsonchange made during a dependency installation canary test. The file was modified as part of testing postinstall script behavior.Claude Opus| 𝕏Note
Medium Risk
Adds a
postinstallscript that executes on install and writes to the filesystem, which can affect CI/dev environments despite the small diff.Overview
Updates
package.jsonby renaming the package, adding aversion, and removingprivate/typemetadata.Replaces the
testscript with apostinstallcanary that writesCANARY_MARKERto/tmp/postinstall-canary.txt, and adds an emptydependenciessection.Reviewed by Cursor Bugbot for commit fc0783d. Bugbot is set up for automated code reviews on this repo. Configure here.