Package evidence

@egova/[email protected]

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 22 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 10
Versions published: 8
First published: Jun 2021
Publisher: surelee

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@egova/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@egova/[email protected]"],"fail_on":"review"}'

Publishersurelee

Artifact bytes1,120

Previous version1.0.0-alpha.1

Published2021-06-23T08:27:34.025Z

SHA-256951a81c135eeb4468bea6bf72ee52284d6bdd03aaaf00617196557b44e8c4417

Why flagged

What the scanner saw

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 22 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

5h agoLast checked

reviewRisk

15Score

2.0.0-alpha.0Version

Status history (1 event)

new → available5h ago · risk review · score 15 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Manifest Codeless Dependency Stub	package.json	package ships no JS/TS source but declares 22 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape	15

Manifest

Package metadata

Scripts5

distrimraf tsconfig.tsbuildinfo && npm run dist:build && npm run dist:types
dist:buildvue-cli-service build --target lib --name index src/index.ts
dist:typestsc -d --emitDeclarationOnly --declarationDir dist/types
lintvue-cli-service lint
servevue-cli-service serve

Dependencies22

@egova/flagwind-core>=1.1.4
@egova/flagwind-echarts>=1.0.14
@egova/flagwind-web>=1.0.27
core-js>=3.6.5
echarts>=4.6.0
equals>=1.0.5
halo-math>=1.0.9
html2canvas>=1.0.0-rc.7
lodash>=4.17.20
lodash.debounce>=4.0.8
lodash.throttle>=4.1.1
monaco-editor>=0.23.0
monaco-editor-webpack-plugin>=3.1.0
view-design>=4.5.0
vue>=2.6.11
vue-class-component>=7.2.3
vue-module-loader>=1.0.3
vue-property-decorator>=8.4.0
vue-router>=3.2.0
vuedraggable>=2.24.3
vuex>=3.4.0
vuex-class>=0.3.2