chore: update package.json for canary test

[pullfrog]

Updates package.json as part of dependency installation canary test. The postinstall script writes a marker file to /tmp/postinstall-canary.txt to verify whether scripts are executed during npm install.

  ^{｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-only fixture change with no production app logic; the postinstall writes a local temp file when install scripts run.

Overview
Reconfigures package.json from a minimal Vitest fixture (test-repo, private, type: module, test script) into a test-pkg@1.0.0 package used to verify npm install behavior.

Adds a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt, and drops the Vitest test script in favor of an empty dependencies object.

^{Reviewed by Cursor Bugbot for commit 9c0932c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9b01c44. Configure here.}

[cursor]

Removal of test script breaks existing test suite

Medium Severity

The "test": "vitest run" script was removed even though test/math.test.ts still exists and imports from vitest. Running npm test will now fail. The stated intent was to add a postinstall canary script, but the entire scripts block was replaced instead of augmented, which inadvertently drops the test script, the "private": true flag, and the "type": "module" declaration.

 

^{Reviewed by Cursor Bugbot for commit 9b01c44. Configure here.}

[cursor]

Removing private flag enables accidental publishing with postinstall

High Severity

The "private": true field was removed at the same time a postinstall script performing filesystem writes (echo CANARY_MARKER > /tmp/postinstall-canary.txt) was added. Without the private guard, this package can be accidentally published to npm, causing the postinstall script to execute on every consumer's machine during npm install. This is a well-known supply chain attack pattern.

 

^{Reviewed by Cursor Bugbot for commit 9b01c44. Configure here.}