Published package runs an obsolete patch-package postinstall hook
Installing Counterfact invoked an unnecessary lifecycle script, creating avoidable friction for package managers with strict build-script policies and an unnecessary supply-chain concern.
This page traces one detailed external-report case through the available source and release evidence. The public-record census includes additional discovery channels and separately identified recurrences.
- Report
- Issue #2075
- Reporter
- iki
- Reported
- May 15, 2026
- Reported version
- Not specified; 2.11.0 was current
- Matched window
- Included
- First affected release entered matched window
- No
- Origin classification
- Pre-existing before 2026
- Classification confidence
- High
- Chronology confidence
- High
- Accepted correction
- PR #2076
- First fixed release
- 2.12.0
- Report to release
- 1.09 elapsed daysReport: 2026-05-15T16:00:38Z; corrected publication: 2026-05-16T18:11:36.115Z.
Historical test demonstration and reproducible commands
Finding
Published package manifests show the hook from 0.39.0 onward, including 2025 releases; no 2026 change introduced it.
Evidence trail
Origin
Exact origin: c4dda369, committed April 10, 2024; first affected release 0.39.0. A maintenance change accidentally restored patch-package as a production dependency and postinstall script after the package no longer shipped patches.
Source history and behavioral evidence
Package history traces the reintroduced script to a 2024 lint-maintenance commit. Inspection of published manifests corroborates that affected packages had the hook but no patches directory. The fix removes the dependency, script, and obsolete CI step.
Release chronology
The hook first shipped in 0.39.0. Its removal reached 2.12.0 one day after the report.