Published package runs an obsolete patch-package postinstall hook
Installing Counterfact invoked an unnecessary lifecycle script, creating avoidable friction for package managers with strict build-script policies and an unnecessary supply-chain concern.
- Report
- Issue #2075
- Reporter
- iki
- Reported
- May 15, 2026
- Reported version
- Not specified; 2.11.0 was current
- Primary matched window
- Included
- First affected release entered primary window
- No
- Origin classification
- Pre-existing before 2026
- Classification confidence
- High
- Chronology confidence
- High
- Accepted correction
- PR #2076
- First fixed release
- 2.12.0
- Report to release
- 1 day
Finding
Published package manifests show the hook from 0.39.0 onward, including 2025 releases; no 2026 change introduced it.
Evidence trail
Origin
Exact origin: c4dda369, committed April 10, 2024; first affected release 0.39.0. A maintenance change accidentally restored patch-package as a production dependency and postinstall script after the package no longer shipped patches.
Source history and behavioral evidence
Package history traces the reintroduced script to a 2024 lint-maintenance commit. Inspection of published manifests corroborates that affected packages had the hook but no patches directory. The fix removes the dependency, script, and obsolete CI step.
Release chronology
The hook first shipped in 0.39.0. Its removal reached 2.12.0 one day after the report.