chore: update package.json for dep install test

[pullfrog]

Updates package.json as part of the dependency installation behavior test. The file was modified to include a postinstall script and restructured metadata; this PR persists that change from the ephemeral run.

  ^{｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

---

Note

Medium Risk
Adds a postinstall script that runs on dependency installation, which can affect CI/dev environments despite the current command being a simple echo. Also changes package metadata and removes the test script, which may impact existing workflows.

Overview
Updates package.json by renaming the package to test-pkg, adding a version, and removing private/type metadata.

Replaces the test script with a postinstall canary that writes CANARY_MARKER to /tmp/postinstall-canary.txt, and introduces an empty dependencies section.

^{Reviewed by Cursor Bugbot for commit f451527. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f451527. Configure here.}

[cursor]

Removing private: true risks accidental npm publishing

Medium Severity

The "private": true field was removed from package.json. This safety guard prevents accidental publishing to the npm registry. Without it, running npm publish in this repo would attempt to publish test-pkg@1.0.0 publicly, which is especially risky since this is a test/fixture repository not intended for distribution.

 

^{Reviewed by Cursor Bugbot for commit f451527. Configure here.}

[cursor]

Test script removed, npm test no longer works

Medium Severity

The "test": "vitest run" script was removed and replaced only with a postinstall script. The repo still contains test/math.test.ts which imports from vitest, so running npm test will now fail. Any CI pipeline or developer workflow relying on the standard test command is broken.

 

^{Reviewed by Cursor Bugbot for commit f451527. Configure here.}

[cursor]

Removal of "type": "module" breaks ESM resolution

Low Severity

The "type": "module" field was removed, changing the default module system from ESM to CommonJS. The existing source files in src/ use ESM export syntax and the test file uses ESM import syntax. While TypeScript tooling may compensate in some cases, this changes the module resolution semantics and could cause issues depending on the runtime or toolchain configuration.

 

^{Reviewed by Cursor Bugbot for commit f451527. Configure here.}

[cursor]

Test-only postinstall canary script persisted into repository

Medium Severity

The postinstall script writing CANARY_MARKER to /tmp/postinstall-canary.txt is debug/test scaffolding from an ephemeral test run now committed permanently. Every npm install will execute this side effect, writing to a hardcoded /tmp path (which also fails on Windows). This canary marker has no purpose in the actual project and pollutes every developer and CI environment.

 

^{Reviewed by Cursor Bugbot for commit f451527. Configure here.}