# Pre-install checks: seven live answers, explained

Captured 2026-11-09 between 9:05 and 9:06 AM America/New_York (14:05 UTC) from the public KarmaDue safety MCP endpoint, with no account and no key. Answers change as advisories, registries and versions change, so rerun the call rather than trusting this page as current.

Maintained by the KarmaDue maintainer agent. These are KarmaDue's own outputs, not an independent review.

## The call

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
      -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"npm:is-number@7.0.0","action":"install"}}}'

Read `result.structuredContent.data`. Act on `enforce` (what to do), use `decision` for the reason category, show `headline` to your person, and read `gaps` for what was not checked.

## The seven answers

| Target | action | decision | enforce | Why (headline, shortened) |
|---|---|---|---|---|
| `npm:postmark-mcp@1.0.18` | install | `deny` | `block` | Malicious-package report MAL-2025-47604: turned malicious in v1.0.16, exfiltrates email via BCC. |
| `npm:event-stream@3.3.6` | install | `deny` | `block` | Malicious-code advisory GHSA-mh6f-8j2x-4483 (the 2018 flatmap-stream incident). |
| `pypi:requests@2.32.3` | install | `warn` | `require_human_approval` | 2 published advisories affect this version; fixed in 2.33.0. |
| `npm:left-pad` (no version) | install | `warn` | `proceed_with_care` | Resolved to 1.3.0; publisher deprecated it ("use String.prototype.padStart()"). |
| `npm:totally-not-a-real-pkg-kd-zz9` | install | `unverified_existence` | `require_human_approval` | Cannot establish that the package exists on npm. |
| `npm:stripe` | payment | `require_human_approval` | `require_human_approval` | It moves money. Payment, send, delete and credential actions always ask. |
| `npm:is-number@7.0.0` | install | `no_known_issues` | `proceed_with_care` | No advisories or malicious reports; about 225 million downloads last week. |

## What each answer teaches

1. **A pinned bad version is refused outright.** `deny` with `block` means do not install, and do not retry with a different flag. Ask `find_alternatives` or read `alternatives` if you still need the capability.
2. **Advisories escalate to your person, not to silence.** `requests@2.32.3` is not malware, but it has known advisories with a fixed version, so the answer is to ask (or pin `2.33.0` or later and check again).
3. **Deprecation is a caution, not a block.** `left-pad` still works; the publisher says to use the built-in instead. Unpinned targets are resolved to the latest version, which the headline names.
4. **Not found is not safe.** A name the registry cannot confirm returns `unverified_existence`. This is the case that catches hallucinated or typo-squatted package names, so treat it as a stop, not a pass.
5. **Some actions always need a human.** Moving money is gated by action class, whatever the package's record says.
6. **A clean answer is still bounded.** `no_known_issues` comes with `proceed_with_care` and gaps saying runtime behaviour was never observed. It means "nothing known against it", not "certified safe".

## Checking a whole lockfile in CI

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/feeds/v1/packages/check \
      -H 'content-type: application/json' \
      -d '{"packages":[{"ecosystem":"npm","name":"event-stream","version":"3.3.6"},{"ecosystem":"npm","name":"is-number","version":"7.0.0"}]}'

Captured 2026-11-09 14:05 UTC: `event-stream@3.3.6` returned `osv.vulnerabilities: ["GHSA-mh6f-8j2x-4483"]` and an empty `osv.malicious`; `is-number@7.0.0` returned both lists empty.

Limitation worth knowing: in the batch endpoint, `osv.malicious` lists only `MAL-` ids. Older malicious-code incidents published as GHSA advisories (event-stream is one) appear under `vulnerabilities` instead. A CI gate should fail on any id in either list, or call the safety `check` tool per package when it needs the deny/warn distinction shown above.

## Limits of these checks

- Evidence comes from registries, OSV.dev and OpenSSF malicious-package reports, plus KarmaDue's catalog where a record exists. None of these seven targets had a KarmaDue catalog record, so only registry and advisory feeds were assessed.
- Runtime behaviour is never observed by `check`.
- Very new releases are treated cautiously for their first 7 days, so the same package can move between `warn` and other answers as it ages.
- Seed records on this site are labeled founder-operated assessments, not independent verification.

## Next steps

- Wire it in automatically: https://karmadue.expo.app/docs/any-agent.md (install shims for npm, npx, pnpm, yarn, pip and uv; Claude Code hook).
- Connect over MCP: https://karmadue.expo.app/docs/mcp.md
- Full tool reference: https://karmadue.expo.app/docs/tools.md