Package evidence

@bitgo-beta/[email protected]

Large Javascript Payload: 39818207 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 7,075Niche · −30% score
Versions published: 2,488Mature · −50% score
First published: Sep 2022
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@bitgo-beta/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@bitgo-beta/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes16,774,717

Previous version14.2.1-beta.1987

Published2026-05-26T13:36:59.814Z

SHA-25657d50fc0ca70584bf926297229d1d01fbbf7d05a3abea6f353d859b96c8dff1d

Why flagged

What the scanner saw

Large Javascript Payload: 39818207 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

21d agoLast checked

reviewRisk

6Score

14.2.1-beta.1988Version

Status history (1 event)

new → available21d ago · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/browser/BitGoJS.min.js	39818207 bytes	10
medium	Large Javascript Payload	package/dist/test/v2/unit/internal/tssUtils/mocks/ecdsaNtilde.js	2864040 bytes	10

Manifest

Package metadata

Scripts22

auditif [ "$(npm --version | cut -d. -f1)" -ge "6" ]; then npm audit; else echo "npm >= 6 required to perform audit. skipping..."; fi
browser-testkarma start karma.conf.js
buildyarn tsc --build --incremental --verbose .
check-fmtprettier --check '**/*.{ts,js,json}'
cleanrm -r dist/*
compileyarn webpack-prod
compile-dbgyarn webpack-dev
compile-testyarn webpack-dev
coveragenyc -- npm run unit-test
fmtprettier --write '{src,test}/**/*.{ts,js,json}'
gen-docstypedoc
integration-testnyc -- mocha "test/v2/integration/**/*.ts"
linteslint --quiet .
preparenpm run build
prepublishOnlynpm run compile
testnpm run coverage
unit-testNODE_OPTIONS=--max-old-space-size=8192 mocha 'test/v2/unit/**/*.ts' 'test/unit/**/*.ts'
unprettiedgrep -R -L --include '*.ts' --include '*.js' --include '*.json' '@prettier' src test
upload-artifactsnode scripts/upload-test-reports.js
upload-docsnode scripts/upload-docs.js
webpack-devcross-env NODE_ENV=development webpack
webpack-prodNODE_OPTIONS=--max-old-space-size=4096 cross-env NODE_ENV=production webpack

Dependencies94

@bitgo-beta/abstract-lightning1.0.1-beta.1396
@bitgo-beta/abstract-utxo1.1.1-beta.2014
@bitgo-beta/account-lib2.20.1-beta.1991
@bitgo-beta/sdk-api1.10.1-beta.1780
@bitgo-beta/sdk-coin-ada2.3.14-beta.1779
@bitgo-beta/sdk-coin-algo2.8.9-beta.259
@bitgo-beta/sdk-coin-apechain1.0.1-beta.839
@bitgo-beta/sdk-coin-apt1.0.1-beta.1221
@bitgo-beta/sdk-coin-arbeth1.0.1-beta.1634
@bitgo-beta/sdk-coin-asi1.0.1-beta.868
@bitgo-beta/sdk-coin-atom3.1.2-beta.1777
@bitgo-beta/sdk-coin-avaxc1.1.1-beta.2004
@bitgo-beta/sdk-coin-avaxp5.7.3-beta.93
@bitgo-beta/sdk-coin-baby1.0.1-beta.1120
@bitgo-beta/sdk-coin-bch1.1.1-beta.2005
@bitgo-beta/sdk-coin-bcha1.1.1-beta.2004
@bitgo-beta/sdk-coin-bera1.0.1-beta.1633
@bitgo-beta/sdk-coin-bld1.0.1-beta.1739
@bitgo-beta/sdk-coin-bsc1.0.1-beta.2004
@bitgo-beta/sdk-coin-bsv1.1.1-beta.2004
@bitgo-beta/sdk-coin-btc1.0.2-beta.2004
@bitgo-beta/sdk-coin-btg1.1.1-beta.2004
@bitgo-beta/sdk-coin-canton1.0.1-beta.549
@bitgo-beta/sdk-coin-celo1.1.1-beta.2003
@bitgo-beta/sdk-coin-coredao1.0.0-beta.1212
@bitgo-beta/sdk-coin-coreum1.0.1-beta.1621
@bitgo-beta/sdk-coin-cosmos1.0.0-beta.758
@bitgo-beta/sdk-coin-cronos1.0.1-beta.912
@bitgo-beta/sdk-coin-cspr1.2.19-beta.1777
@bitgo-beta/sdk-coin-dash1.1.1-beta.2005
…and 64 more.

Optional dependencies4

@ethereumjs/common^2.6.5
@ethereumjs/tx^3.3.0
ethereumjs-abi^0.6.5
ethereumjs-util7.1.5