PkgRadar

Package evidence

@duetds/[email protected]

Large Javascript Payload: 2339953 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
689Mature · −50% score
First published
Mar 2019
Publisher
kasimir-dka

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@duetds/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@duetds/[email protected]"],"fail_on":"review"}'
Publisherkasimir-dka
Artifact bytes2,361,947
Previous version10.1.0
Published2026-05-28T10:04:46.391Z
SHA-25681f16ed721e0c3e92221b67cb7e9f8be3c216ceca337a6a2e32344c38b6958ec

Why flagged

What the scanner saw

Large Javascript Payload: 2339953 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
6Score
10.1.1Version
Status history (1 event)
  1. new → available · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/hydrate/index.js2339953 bytes10
mediumLarge Javascript Payloadpackage/hydrate/index.mjs2339744 bytes10

Manifest

Package metadata

Scripts20
  • buildstencil build
  • build:componentsstencil build --dev
  • build:components:watchstencil build --dev --watch
  • clear-vizdifnode -e 'require("./prepare-vizdif").clear()'
  • fixturesnode fixtures.js
  • jest:cijest --ci
  • jest:watchjest --watch
  • koalerna exec 'npm run start:dev:watch' --scope '@duetds/server'
  • koa:killkill -9 $(lsof -ti:3334)
  • koa:testlerna exec 'npm run koa:serve:ci&' --scope '@duetds/server'
  • percy-snapshotpercy snapshot ./percy.js
  • prepare-vizdifnode -e 'require("./prepare-vizdif").prepare()'
  • startrun-p koa build:components:watch
  • testrun-s -c koa:test jest:watch koa:kill
  • test:cirun-p koa:test test:scss:ci test:ci:2
  • test:ci:2run-s -c jest:ci koa:kill
  • test:percyrun-s -c build prepare-vizdif koa:test percy-snapshot koa:kill clear-vizdif
  • test:scssstylelint **/*.scss --config ../../.stylelintrc.js
  • test:scss:cinpm run test:scss --silent
  • versionnpm run build
Dependencies2
  • @floating-ui/dom1.2.9
  • body-scroll-lock3.1.5