PkgRadar

npm · registry.npmjs.org

com.valectric.mooserunner

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Why PkgRadar flagged 2.2.8

SeveritySignalEvidence
mediumManifest Codeless Dependency Stubpackage ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.2.8Review42026-06-16
2.2.5Review42026-06-15
2.2.4Review42026-06-15
2.2.3Review42026-06-12
2.2.2Review42026-06-12
2.2.1Review42026-06-12
2.2.0Review42026-06-12
2.1.40Review42026-06-11
2.1.39Review42026-06-11
2.1.38Review42026-06-11
2.1.37Review42026-06-10
2.1.36Review42026-06-09
2.1.35Review42026-06-09
2.1.34Review42026-06-08
2.1.33Review42026-06-07
2.1.32Review42026-06-06
2.1.31Review42026-06-06
2.1.30Review42026-06-05
2.1.29Review42026-06-05
2.1.28Review42026-06-05
2.1.27Review42026-06-05
2.1.26Review42026-06-05
2.1.25Review42026-06-04
2.1.24Review42026-06-04
2.1.23Review42026-06-04
2.1.21Review42026-06-03
2.1.22Review42026-06-03
2.1.13Review42026-06-03
2.1.14Review42026-06-03
2.1.11Review42026-06-03
2.1.10Review42026-06-03
2.1.8Review42026-06-03
2.1.9Review42026-06-03
2.1.6Review42026-06-03
2.1.5Review42026-06-03
2.1.4Review152026-06-02

Block this in CI

PkgRadar gates com.valectric.mooserunner (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence