PkgRadar

Package evidence

@brownnrl/[email protected]

Known Indicator Filename: package/dist/bundle.js

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@brownnrl/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@brownnrl/[email protected]"],"fail_on":"high"}'
Publisherbrownnrl
Artifact bytes98,312
Previous version0.1.0
Published2026-05-23T17:22:53.733Z
SHA-25664de38f9749a31ccf9f8ccf7589e1ed15a96d5f9f959c2e311842b16224f2e88

Why flagged

What the scanner saw

Known Indicator Filename: package/dist/bundle.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
45Score
0.1.1Version
Status history (1 event)
  1. new → available · risk high · score 45 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

brownnrl

2 members · evidence strength 53

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highKnown Indicator Filenamepackage/dist/bundle.jspackage/dist/bundle.js45

Manifest

Package metadata

Scripts11
  • buildtsc --noEmit
  • bundlenpx webpack
  • bundle:prodNODE_ENV=production npx webpack
  • coveragec8 mocha --reporter min tests/SnapshotTest.ts tests/CircleTest.ts tests/ColorsTest.ts tests/LineTest.ts tests/ParseParamTest.ts tests/PlaneTest.ts tests/PointTest.ts tests/PolygonTest.ts tests/PolyhedronTest.ts tests/SectorTest.ts tests/SlateTest.ts tests/SphereTest.ts
  • coverage:reportc8 report --reporter=html
  • coverage:unitc8 mocha --reporter min tests/CircleTest.ts tests/ColorsTest.ts tests/LineTest.ts tests/ParseParamTest.ts tests/PlaneTest.ts tests/PointTest.ts tests/PolygonTest.ts tests/PolyhedronTest.ts tests/SectorTest.ts tests/SlateTest.ts tests/SphereTest.ts
  • prepublishOnlynpm run test:unit && npm run bundle:prod
  • snapshots:cleanrm -rf tests/snapshots && mkdir -p tests/snapshots && touch tests/snapshots/.gitkeep
  • testnpm run test:snapshot && npm run test:unit
  • test:snapshotnpm run bundle && mocha --reporter min tests/SnapshotTest.ts
  • test:unitmocha tests/CircleTest.ts tests/ColorsTest.ts tests/LineTest.ts tests/ParseParamTest.ts tests/PlaneTest.ts tests/PointTest.ts tests/PolygonTest.ts tests/PolyhedronTest.ts tests/SectorTest.ts tests/SlateTest.ts tests/SphereTest.ts