Package evidence

@chainsafe/[email protected]

Known Indicator Filename: package/lib/options/beaconNodeOptions/execution.js

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 2,467Niche · −30% score
Versions published: 3,562Mature · −50% score
First published: Apr 2020
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@chainsafe/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@chainsafe/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes241,785

Previous version1.44.0-dev.1f0e8b5a5f

Published2026-05-29T10:45:02.645Z

SHA-2565fc0c738405e5626042c63e11014839b5380a50bd02f17e1b061664234a55de7

Why flagged

What the scanner saw

Known Indicator Filename: package/lib/options/beaconNodeOptions/execution.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

13Score

1.44.0-dev.464b9ae7abVersion

Status history (1 event)

new → available15d ago · risk review · score 13 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/lib/options/beaconNodeOptions/execution.js	package/lib/options/beaconNodeOptions/execution.js	45

Manifest

Package metadata

Scripts18

buildtsgo -p tsconfig.build.json && pnpm write-git-data
build:releasepnpm clean && pnpm run build
build:watchtsgo -p tsconfig.build.json --watch
check-buildnode -e "(async function() { await import('./lib/index.js') })()" lodestar --help
check-readmepnpm exec ts-node ../../scripts/check_readme.ts
check-typestsgo
cleanrm -rf lib && rm -f *.tsbuildinfo
docs:buildnode --loader ts-node/esm ./docsgen/index.ts
lintbiome check src/ test/
lint:fixpnpm run lint --write
testpnpm test:unit && pnpm test:e2e
test:e2evitest run --project e2e --project e2e-mainnet
test:sim:backup_eth_providerLODESTAR_PRESET=minimal DOTENV_CONFIG_PATH=../../.env.test node -r dotenv/config --loader ts-node/esm test/sim/backupEthProvider.test.ts
test:sim:endpointsLODESTAR_PRESET=minimal DOTENV_CONFIG_PATH=../../.env.test node -r dotenv/config --loader ts-node/esm test/sim/endpoints.test.ts
test:sim:mixedclientLODESTAR_PRESET=minimal DOTENV_CONFIG_PATH=../../.env.test node -r dotenv/config --loader ts-node/esm test/sim/mixedClient.test.ts
test:sim:multiforkLODESTAR_PRESET=minimal DOTENV_CONFIG_PATH=../../.env.test node -r dotenv/config --loader ts-node/esm test/sim/multiFork.test.ts
test:unitvitest run --project unit --project unit-minimal
write-git-datanode lib/util/gitData/writeGitData.js

Dependencies34

@chainsafe/bls-keygen^0.4.0
@chainsafe/bls-keystore^3.1.0
@chainsafe/blst^2.2.0
@chainsafe/discv5^12.0.1
@chainsafe/enr^6.0.1
@chainsafe/persistent-merkle-tree^1.2.5
@chainsafe/pubkey-index-map^3.0.0
@chainsafe/ssz^1.4.0
@chainsafe/threads^1.11.3
@libp2p/crypto^5.1.13
@libp2p/interface^3.1.0
@libp2p/peer-id^6.0.4
@lodestar/api^1.44.0-dev.464b9ae7ab
@lodestar/beacon-node^1.44.0-dev.464b9ae7ab
@lodestar/config^1.44.0-dev.464b9ae7ab
@lodestar/db^1.44.0-dev.464b9ae7ab
@lodestar/logger^1.44.0-dev.464b9ae7ab
@lodestar/params^1.44.0-dev.464b9ae7ab
@lodestar/state-transition^1.44.0-dev.464b9ae7ab
@lodestar/types^1.44.0-dev.464b9ae7ab
@lodestar/utils^1.44.0-dev.464b9ae7ab
@lodestar/validator^1.44.0-dev.464b9ae7ab
@multiformats/multiaddr^13.0.1
deepmerge^4.3.1
ethers^6.7.0
find-up^6.3.0
inquirer^9.1.5
js-yaml^4.1.0
prom-client^15.1.0
proper-lockfile^4.1.2
…and 4 more.