PkgRadar

npm · registry.npmjs.org

@byomakase/omakase-player

Remote Dependency Spec: dependencies.smp-imsc="github:bbc/imscJS#v1.0.11-9"

Why PkgRadar flagged 1.0.0-RC3

SeveritySignalEvidence
mediumRemote Dependency Specdependencies.smp-imsc="github:bbc/imscJS#v1.0.11-9" · package.json
mediumNew Remote Dependency Vs Previousdependencies.smp-imsc added in 1.0.0-RC3 vs 0.25.4: "github:bbc/imscJS#v1.0.11-9" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
0.25.4Review22026-06-15
0.25.4-SNAPSHOT.1773786614Review22026-06-15
0.25.4-SNAPSHOT.1778676207Review22026-06-15
1.0.0-RC3High risk292026-06-15

Block this in CI

PkgRadar gates @byomakase/omakase-player (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @byomakase/[email protected]