PkgRadar

Package evidence

@bhsd/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
163
Versions published
232Mature · −50% score
First published
May 2023
Publisher
bhsd

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@bhsd/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@bhsd/[email protected]"],"fail_on":"review"}'
Publisherbhsd
Artifact bytes935,039
Previous version3.18.0
Published2026-05-20T10:32:16.351Z
SHA-256382cfadd299f92f4edd4635e60105195bc4f423ee4fa5360389a336232f2be2b

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
3.18.1Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts22
  • buildnpm run build:css && rm -rf dist/ && npm run build:demo && npm run build:core && npm run build:wiki && npm run build:mw && gsed -i '/^\/\/ /d' dist/*.js && eslint --no-config-lookup -c eslint.dist.mjs dist/*.min.js
  • build:corenode build.cjs && tsc && esbuild src/config.ts src/javascript-globals.ts --bundle --format=esm --external:@lezer/highlight --outdir=dist --legal-comments=inline && rm dist/*-page.{js,d.ts} && gsed -i 's|globals/globals.json|globals|' dist/javascript-globals.d.ts && grep -rl --include='*.d.ts' '@private' dist/ | xargs gsed -i -E '/^\s+\/\*\* @private/,+1d'
  • build:cssesbuild ./css/index.css --bundle --minify --outfile=mediawiki.css --supported:nesting=false
  • build:demoesbuild ./bundle/*.ts --charset=utf8 --bundle --format=esm --outdir=build --drop-labels=GH && esbuild ./bundle/mediawiki.ts --charset=utf8 --bundle --minify --target=es2019 --format=esm --outfile=dist/demo.min.js
  • build:gh-pageesbuild src/*-page.ts --charset=utf8 --bundle --target=es2019 --format=esm --outdir=. --external:/codemirror-mediawiki/dist/main.min.js --external:/codemirror-mediawiki/dist/demo.min.js --external:/wikiparser-node/extensions/dist/test-page-common.js
  • build:mwMODE=mw node build.cjs && esbuild ./mw/config.ts --charset=utf8 --bundle --target=es2019 --format=esm --outfile=dist/mwConfig.js --external:@bhsd/browser --external:@bhsd/cm-util
  • build:testrm -rf test/dist/; tsc --project test/tsconfig.json && npm test
  • build:wikiMODE=wiki node build.cjs
  • checkoutgit checkout wikitext wikitext.html wikitext-page.js wikitext-page.css
  • diffbash diff.sh
  • lintnpm run lint:ts && npm run lint:css && npm run lint:md
  • lint:cssstylelint '**/*.css'
  • lint:mdmarkdownlint-cli2 '**/*.md'
  • lint:tstsc --noEmit && tsc --project mw/tsconfig.json --noEmit && tsc --project test/tsconfig.json --noEmit && tsc --project bundle/tsconfig.json --noEmit && eslint --cache .
  • lsnpm i --package-lock-only && npm ls --package-lock-only --all --omit=dev
  • prepublishOnlynpm run build
  • profnode test/dist/prof.js
  • servernpm run test:end; http-server .. -c-1 --cors -s &
  • testmocha test/dist/*.test.js && mocha test/dist/test.js
  • test:endpkill -x http-server
  • test:mathmocha test/dist/math.js
  • test:realnode test/dist/real.js
Dependencies26
  • @bhsd/browser^0.4.0
  • @bhsd/cm-util^2.0.0
  • @bhsd/codemirror-css-color-picker^7.1.0
  • @bhsd/common^2.2.1
  • @bhsd/eslint-browserify^10.4.0
  • @bhsd/lezer-abusefilter^0.3.1
  • @bhsd/lezer-json^2.0.0
  • @bhsd/stylelint-util^1.0.2
  • @codemirror/autocomplete^6.20.2
  • @codemirror/commands^6.10.3
  • @codemirror/lang-css^6.3.1
  • @codemirror/lang-html^6.4.11
  • @codemirror/lang-javascript^6.2.5
  • @codemirror/lang-vue^0.1.3
  • @codemirror/language^6.12.3
  • @codemirror/legacy-modes^6.5.3
  • @codemirror/lint^6.9.6
  • @codemirror/search^6.7.0
  • @codemirror/state^6.6.0
  • @codemirror/view^6.42.1
  • cm6-theme-nord^0.2.0
  • eslint^10.4.0
  • globals^17.6.0
  • luacheck-browserify^0.11.0
  • stylelint^17.11.1
  • wikiparser-node^1.40.0