PkgRadar

npm · registry.npmjs.org

@haybarn/ext-vgi-h1-5-3

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 5 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Why PkgRadar flagged 202606.5.131531

SeveritySignalEvidence
mediumManifest Codeless Dependency Stubpackage ships no JS/TS source but declares 5 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
202606.5.131531Review152026-06-05
202606.4.212938Review152026-06-05
202606.4.190036Review152026-06-04
202606.2.1726223Review152026-06-04
202606.4.140516Review152026-06-04
202606.2.172622Review152026-06-04
202606.1.225318Review152026-06-02
202606.1.120408Review152026-06-01
202605.30.191846Low risk02026-05-30
202605.26.133448Low risk02026-05-27
202605.26.34331Low risk02026-05-26
202605.22.43830Low risk02026-05-25
202605.25.201631Low risk02026-05-25

Block this in CI

PkgRadar gates @haybarn/ext-vgi-h1-5-3 (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @haybarn/[email protected]
Start free — 25 scans / moView full evidence