PkgRadar

npm · registry.npmjs.org

@homebridge/homebridge-apt-pkg

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Why PkgRadar flagged 2.0.7-beta.20260611

SeveritySignalEvidence
mediumManifest Codeless Dependency Stubpackage ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.0.7-beta.20260611Review42026-06-11
2.0.7-beta.20260606Review42026-06-11
2.0.7-beta.20260605Review42026-06-05
2.0.6Review42026-06-05
2.0.6-beta.20260604Review42026-06-04
2.0.6-alpha.20260604Review42026-06-04
2.0.6-alpha.20260602Review42026-06-02
2.0.6-alpha.20260601Review42026-06-01
2.0.6-legacy.20260601Review42026-06-01
2.0.6-beta.20260531Low risk02026-05-31
2.0.6-beta.20260529Low risk02026-05-29
2.0.6-beta.20260528Low risk02026-05-28
2.0.6-beta.20260527Low risk02026-05-27
2.0.6-legacy.20260522Low risk02026-05-24
2.0.6-beta.20260524Low risk02026-05-24

Block this in CI

PkgRadar gates @homebridge/homebridge-apt-pkg (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @homebridge/[email protected]
Start free — 25 scans / moView full evidence