Package evidence

@block-auth.io/[email protected]

Large Javascript Payload: 4218088 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 355
Versions published: 19Established · −30% score
First published: Dec 2024
Publisher: wenqi.zhou

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@block-auth.io/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@block-auth.io/[email protected]"],"fail_on":"review"}'

Publisherwenqi.zhou

Artifact bytes8,981,738

Previous version0.8.3

Published2026-06-01T14:33:41.830Z

SHA-2565b87a456805a4f557038e1bdbd69256880a532725ce7630a39b84c420c82098b

Why flagged

What the scanner saw

Large Javascript Payload: 4218088 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

16d agoLast checked

lowRisk

0Score

0.8.4Version

Status history (1 event)

new → available16d ago · risk low · score 0 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/dist/main-H_LbWZDl.cjs	4218088 bytes	0
low	Large Javascript Payload	package/dist/main-Dm6k8log.js	5450509 bytes	0

Manifest

Package metadata

Scripts21

buildvite build
build:localENV_CONFIG=local vite build
build:typestsc
ciyarn lint && yarn format && yarn test && yarn build && yarn build:types && yarn pack
ci:compileyarn ci && yarn compile:auth
ci:withcssyarn css && yarn lint && yarn format && yarn test && yarn build && yarn build:types && yarn pack
cleannpx rm -rf dist dist-stories dist-docs .coverage package-lock.json junit.xml *.tgz node_modules yarn.lock
cleanrmrm -rf dist dist-stories dist-docs .coverage package-lock.json junit.xml *.tgz node_modules yarn.lock
compile:authcp -R blockauth-sdk-react-*.tgz ../blockauth-auth/libs/
compile:dashboardcp -R blockauth-sdk-react-*.tgz ../blockauth-dashboard/libs/
cssnpx tailwindcss -i "src/assets/css/input.css" -o "src/assets/css/output.css" -o "public/output.css"
css:devnpx tailwindcss -i "./src/assets/css/input.css" -o "./src/assets/css/output.css" -o "public/output.css" --watch
dev:localnpx tailwindcss -i "./src/assets/css/input.css" -o "./src/assets/css/output.css" -o "public/output.css" --watch & ENV_CONFIG=local vite build --watch
docsstorybook dev --docs
docs:buildstorybook build --docs -o dist-docs
formatprettier --write "src/**/*.{js,jsx,}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}" --config ".prettier.json"
linteslint "src/**/*.{js,jsx}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}"
lint:fixeslint --fix "src/**/*.{js,jsx,}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}"
storiesstorybook dev -p 6006
stories:buildstorybook build -o dist-stories
testNODE_OPTIONS=--jitless jest --collectCoverage --coverageDirectory=".coverage/" --ci --reporters=default --reporters=jest-junit --watchAll=false --detectOpenHandles --forceExit --runInBand

Dependencies26

@azure/msal-browser^3.10.0
@azure/msal-react^2.0.12
@block-auth.io/blockauth-lib-react^0.5.0
@coinbase/wallet-sdk4.0.3
@ethersproject/sha25.7.0
@heroicons/react^2.0.18
@radix-ui/react-slider^1.1.2
@react-oauth/google^0.12.1
@reown/appkit1.0.6
@reown/appkit-adapter-ethers51.0.6
@solana/web3.js^1.91.4
blockauth-sdk^0.1.14
buffer^6.0.3
ethers5.7.2
framer-motion^11.0.24
qrcode^1.5.3
react-icons^5.2.1
react-loader-spinner^6.1.6
react-spinners^0.13.8
rollup-plugin-node-polyfills^0.2.1
rpc-websockets7.11.0
stream-browserify^3.0.0
tailwind-children^0.5.0
tweetnacl^1.0.3
vite^5.2.0
zustand^4.3.3