Package evidence

@duetds/[email protected]

Large Javascript Payload: 2343968 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 9,519Niche · −30% score
Versions published: 690Mature · −50% score
First published: Mar 2019
Publisher: kasimir-dka

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@duetds/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@duetds/[email protected]"],"fail_on":"review"}'

Publisherkasimir-dka

Artifact bytes2,369,400

Previous version10.1.1

Published2026-06-04T08:12:40.333Z

SHA-256e0993b16abded2542a98bec1110ddede56b335e5dc02a4eb35291ad4aa194d85

Why flagged

What the scanner saw

Large Javascript Payload: 2343968 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

12h agoLast checked

lowRisk

0Score

10.2.0Version

Status history (1 event)

new → available12h ago · risk low · score 0 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/hydrate/index.js	2343968 bytes	0
low	Large Javascript Payload	package/hydrate/index.mjs	2343759 bytes	0

Manifest

Package metadata

Scripts20

buildstencil build
build:componentsstencil build --dev
build:components:watchstencil build --dev --watch
clear-vizdifnode -e 'require("./prepare-vizdif").clear()'
fixturesnode fixtures.js
jest:cijest --ci
jest:watchjest --watch
koalerna exec 'npm run start:dev:watch' --scope '@duetds/server'
koa:killkill -9 $(lsof -ti:3334)
koa:testlerna exec 'npm run koa:serve:ci&' --scope '@duetds/server'
percy-snapshotpercy snapshot ./percy.js
prepare-vizdifnode -e 'require("./prepare-vizdif").prepare()'
startrun-p koa build:components:watch
testrun-s -c koa:test jest:watch koa:kill
test:cirun-p koa:test test:scss:ci test:ci:2
test:ci:2run-s -c jest:ci koa:kill
test:percyrun-s -c build prepare-vizdif koa:test percy-snapshot koa:kill clear-vizdif
test:scssstylelint **/*.scss --config ../../.stylelintrc.js
test:scss:cinpm run test:scss --silent
versionnpm run build

Dependencies2

@floating-ui/dom1.2.9
body-scroll-lock3.1.5