Compound BuildSCRIPTPROBE9 September 2026
Package releases
NETWORK REACH, PUBLISHER CHANGED
Flag packages that run files when releases change publisher
A package can download and run a file on your machine while you install it. If a different account published that release, I want the combination called out, not buried as two separate facts.
https://scriptprobe.thecompound.tech/
ScriptProbe checks what a package runs during installation. I rate network access high and a changed publisher medium. It returns critical only when both appear together.
The registry doesn't show who held maintainer status 90 days ago. It does show who published each version, so I compare the latest publisher with the previous 10 and check for a new publisher in the last 90 days.
#dev