Package evidence

@cortezaproject/[email protected]

Large Javascript Payload: 2126867 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 289Mature · −50% score
First published: Jan 2020
Publisher: fajfa

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cortezaproject/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cortezaproject/[email protected]"],"fail_on":"review"}'

Publisherfajfa

Artifact bytes3,130,770

Previous version2024.9.9-rc.8

Published2026-05-26T14:30:12.721Z

SHA-256532a3fd5f1584fb6b410b907796cfdf4832daee52fbbc33145fe39797c1861d4

Why flagged

What the scanner saw

Large Javascript Payload: 2126867 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17d agoLast checked

reviewRisk

6Score

2024.9.9Version

Status history (1 event)

new → available17d ago · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/index.cjs	2126867 bytes	10
medium	Large Javascript Payload	package/dist/index.js	2125200 bytes	10

Manifest

Package metadata

Scripts6

buildrollup -c --environment BUILD:production
build:devrollup -c
cdepsyarn link @cortezaproject/corteza-js
linteslint src --ext .js,.ts,.vue
testyarn test:unit
test:unitmocha

Dependencies46

@cortezaproject/corteza-js^2024.9.9
@floating-ui/dom^1.7.4
@fortawesome/fontawesome-svg-core^6.7.2
@fortawesome/free-regular-svg-icons^6.7.2
@fortawesome/free-solid-svg-icons^6.7.2
@fortawesome/vue-fontawesome^2.0.10
@panter/vue-i18next^0.15.0
@popperjs/core^2.11.8
@tiptap/extension-emoji^3.4.2
@tiptap/extension-mention^3.4.2
@tiptap/extension-placeholder^3.4.2
@tiptap/extension-table^3.4.2
@tiptap/extension-text-align^3.4.2
@tiptap/extension-text-style^3.4.2
@tiptap/starter-kit^3.4.2
@tiptap/suggestion^3.4.2
@tiptap/vue-2^3.4.2
bootstrap-vue2.23.1
echarts5.6.0
fuzzysort^3.1.0
html-parse-stringify^3.0.1
i18next^23.16.8
i18next-browser-languagedetector^8.0.4
i18next-http-backend^3.0.2
i18next-multiload-backend-adapter^2.3.0
leaflet^1.9.4
leaflet-geosearch^4.1.0
lodash^4.17.21
mime^4.0.6
moment2.30.1
…and 16 more.