PkgRadar

Package evidence

@brightspot/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
64Mature · −50% score
First published
Jun 2021
Publisher
jpencola

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@brightspot/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@brightspot/[email protected]"],"fail_on":"review"}'
Publisherjpencola
Artifact bytes1,628,261
Previous version4.8.15-pr10057.1
Published2026-04-01T20:09:03.650Z
SHA-256956575116a93020b0785064fc9c44014c2f6312b73c10707623c248183c40970

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
4.8.15Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts5
  • buildyarn build:types && yarn build:js
  • build:jswebpack
  • build:typestsc --emitDeclarationOnly
  • formatyarn lint --fix
  • linteslint "*.ts" "src/**/*.ts"
Dependencies29
  • archiver5.3.0
  • capital-case1.0.4
  • chalk4.1.1
  • chance1.1.7
  • core-js3
  • express4.17.1
  • express-async-handler1.1.4
  • find-parent-dir0.3.1
  • geopattern1.2.3
  • glob7.1.7
  • handlebars4.7.7
  • isbinaryfile4.0.8
  • java-props2.1.3
  • json-dup-key-validator1.0.3
  • lodash4.17.21
  • messageformat2.3.0
  • node-fetch2.7.0
  • puppeteer23.11.0
  • puppeteer-cluster^0.24.0
  • sharp0.29.0
  • stylelint14.0.1
  • stylelint-config-prettier9.0.3
  • stylelint-config-recommended6.0.0
  • stylelint-order5.0.0
  • stylelint-prettier1.2.0
  • tmp0.2.3
  • traverse0.6.6
  • yargs17.0.1
  • zod3.1.0