PkgRadar

npm · registry.npmjs.org

@hangtime/climbing-boards

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Why PkgRadar flagged 1.0.53

SeveritySignalEvidence
mediumManifest Codeless Dependency Stubpackage ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.53Review42026-06-13
1.0.52Review42026-06-13
1.0.51Review42026-06-12
1.0.50Review42026-06-10
1.0.49Review42026-06-09
1.0.48Review42026-06-03
1.0.47Review42026-06-01
1.0.46Low risk02026-05-30
1.0.45Low risk02026-05-28
1.0.44Low risk02026-05-27
1.0.43Low risk02026-05-26
1.0.41Low risk02026-05-24
1.0.42Low risk02026-05-24

Block this in CI

PkgRadar gates @hangtime/climbing-boards (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @hangtime/[email protected]
Start free — 25 scans / moView full evidence