chore: update package.json for dependency install test

[pullfrog]

Updates package.json as part of the dependency installation behavior test. Changes the package name to test-pkg and adds a postinstall script canary.

  ^{｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

---

Note

Medium Risk
Adds a postinstall hook that writes to /tmp, which executes on every install and could have side effects in CI/user environments. Otherwise changes are limited to package.json metadata and removing the prior test script.

Overview
Updates package.json to rename the package to test-pkg and introduce versioning/empty dependencies.

Replaces the prior vitest test script with a postinstall script that writes a CANARY_MARKER file to /tmp on install, and removes the previous private/type: module settings.

^{Reviewed by Cursor Bugbot for commit fd17e7f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a91189a. Configure here.}

[cursor]

Removing private field risks accidental npm publication

High Severity

The "private": true field was removed while simultaneously adding a "version" field and a postinstall script that executes a shell command. Without the private flag, this package can be accidentally published to npm via npm publish. A published package with a postinstall script writing to /tmp would execute on every consumer's machine during install — this mirrors a common supply chain attack vector. The private guard needs to remain in place.

 

^{Reviewed by Cursor Bugbot for commit a91189a. Configure here.}

[cursor]

Test script removed, existing tests cannot run

Medium Severity

The "test": "vitest run" script was replaced entirely by the postinstall canary script. The repository still contains test/math.test.ts which imports from vitest, so npm test will no longer execute the existing test suite. This silently breaks CI and local test workflows.

 

^{Reviewed by Cursor Bugbot for commit a91189a. Configure here.}

[cursor]

Removal of "type": "module" breaks ESM resolution

Medium Severity

The "type": "module" field was removed, which changes the default module system from ESM to CommonJS. The existing source files in src/ use ESM export syntax and the test file uses ESM import syntax. Without this field, Node.js will default to CommonJS resolution for .js output, potentially breaking module loading when the TypeScript is compiled and run.

 

^{Reviewed by Cursor Bugbot for commit a91189a. Configure here.}