PkgRadar

npm · registry.npmjs.org

xgplayer-mp4-loader

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Why PkgRadar flagged 3.0.25-alpha.2

SeveritySignalEvidence
mediumManifest Codeless Dependency Stubpackage ships no JS/TS source but declares 3 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
3.0.25-alpha.3Low risk02026-06-11
3.0.25Low risk02026-06-11
3.0.25-alpha.2Review42026-06-11
3.0.25-rc.11Low risk02026-06-08
3.0.9-rc.34Low risk02026-06-02
3.0.9-rc.33Low risk02026-06-01
3.0.25-rc.9Low risk02026-06-01
3.0.9-rc.32Low risk02026-06-01
3.0.25-alpha.1Low risk02026-05-31
3.0.25-alpha.0Low risk02026-05-31
3.0.25-rc.8Low risk02026-05-29
3.0.9-rc.30Low risk02026-05-26
3.0.9-rc.31Low risk02026-05-26
3.0.9-rc.29Low risk02026-05-26
3.0.25-rc.7Low risk02026-05-26

Block this in CI

PkgRadar gates xgplayer-mp4-loader (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence