PkgRadar

Package evidence

[email protected]

Remote Dependency Spec, Dependency Changed To Remote Vs Previous, New Remote Dependency Vs Previous

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
62Mature · −50% score
First published
Dec 2019
Publisher
jitvarpatil

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

See the evidence — freeAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherjitvarpatil
Artifact bytes379,548
Previous version3.0.9
Published2021-04-27T00:05:27.602Z
SHA-25613a6940a58d68e1817a1286111d1ef7359b116fc14ecc301dfbe7fa3c9074722

Why flagged

What the scanner saw

Remote Dependency Spec

1 candidate cluster(s) currently reference this release.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
216Score
4.0.0Version
Status history (1 event)
  1. new → available · risk high · score 216 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burstactive

Publisher burst: jitvarpatil

3 members · evidence strength 77
Publisher / release actor burstcandidate

Publisher burst: jitvarpatil

3 members · max score 216

Evidence

Static findings

12 static · 10 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
highRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumRemote Dependency Specmanifest—12
mediumDependency Changed To Remote Vs Previousmanifest—12
mediumDependency Changed To Remote Vs Previousmanifest—12
highNew Remote Dependency Vs Previousmanifest—12
mediumNew Remote Dependency Vs Previousmanifest—12
mediumDependency Changed To Remote Vs Previousmanifest—12
mediumDependency Changed To Remote Vs Previousmanifest—12
mediumDependency Changed To Remote Vs Previousmanifest—12
mediumNew Remote Dependency Vs Previousmanifest—12
mediumNew Remote Dependency Vs Previousmanifest—12
mediumRemote Dependency Specmanifest—8
mediumDependency Changed To Remote Vs Previousmanifest—8

Manifest

Package metadata

Dependencies59
  • @jitsi/js-utils1.0.6
  • base64-js1.3.1
  • focus-visible5.1.0
  • i18n-iso-countries3.7.8
  • i18next17.0.6
  • i18next-browser-languagedetector3.0.1
  • i18next-xhr-backend3.0.0
  • jQuery-Impromptugithub:trentrichardson/jQuery-Impromptu#v6.0.0
  • jitsi-meet-loggergithub:jitsi/jitsi-meet-logger#v1.0.0
  • jquery3.5.1
  • jquery-i18next1.2.1
  • js-md50.6.1
  • jwt-decode2.2.0
  • lib-jitsi-meetgithub:jitsi/lib-jitsi-meet#49c4e75f37cfec5a5bdd921c869b6ec1bff8f9d2
  • libflacjsgithub:mmig/libflac.js#93d37e7f811f01cf7d8b6a603e38bd3c3810907d
  • lodash4.17.21
  • moment2.29.1
  • moment-duration-format2.2.2
  • olmhttps://packages.matrix.org/npm/olm/olm-3.2.1.tgz
  • pixelmatch5.1.0
  • promise.allsettled1.0.4
  • punycode2.1.1
  • react16.12
  • react-dom16.12
  • react-emoji-render1.2.4
  • react-i18next10.11.4
  • react-linkify1.0.0-alpha
  • react-nativegithub:jitsi/react-native#891986ec5ecaef65d1c8a7fe472f86cf84fe7551
  • react-native-background-timer2.4.0
  • react-native-calendar-eventsgithub:jitsi/react-native-calendar-events#df48ecdc4e1e90c5352f803ddbab1fa7269b74a7
  • …and 29 more.