Package evidence

@entryscape/[email protected]

Known Indicator Filename: package/src/template/Bundle.js

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 48
Versions published: 68Mature · −50% score
First published: Oct 2019
Publisher: afogelberg.metasolutions

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@entryscape/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@entryscape/[email protected]"],"fail_on":"high"}'

Publisherafogelberg.metasolutions

Artifact bytes964,264

Previous version10.15.1

Published2025-12-18T12:35:43.195Z

SHA-25610f3fec1e3620fb21d549c60fb2e9686df522ed4906cd2215941f1d039ff522a

Why flagged

What the scanner saw

Known Indicator Filename: package/src/template/Bundle.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

30Score

10.16.0Version

Status history (1 event)

new → available23d ago · risk high · score 30 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/src/template/Bundle.js	package/src/template/Bundle.js	45

Show all 6 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/src/template/Bundle.js	package/src/template/Bundle.js	45
low	Obfuscation	package/dist/rdforms.bootstrap.js	matched "\\u2028"	3
low	Obfuscation	package/dist/rdforms.jquery.js	matched "\\u2028"	3
low	Obfuscation	package/dist/rdforms.react.js	matched "\\u2028"	3
low	Obfuscation	package/src/view/react/textEditors.js	matched "\\u00A0"	3
low	Obfuscation	package/src/view/View.js	matched "fromCharCode"	3

Manifest

Package metadata

Scripts8

build:allwebpack --mode=production --config webpack.all.js
build:nodewebpack --config webpack.node.js
build:node:devwebpack --mode=development --config webpack.node.js
build:sampleswebpack --config webpack.samples.js
dev:bootstrapwebpack serve --config webpack.dev.js --env type=bootstrap
dev:jquerywebpack serve --config webpack.dev.js --env type=jquery
dev:reactwebpack serve --config webpack.dev.js --env type=react
serve:sampleswebpack serve --config webpack.samples.serve.js

Dependencies30

@emotion/react^11.14.0
@emotion/styled^11.14.1
@entryscape/rdfjson2.7.7
@fortawesome/fontawesome-free^5.15.4
@mui/icons-material^7.3.4
@mui/material^7.3.4
@mui/x-date-pickers^5.0.20
arrive^2.5.2
bootstrap^4.6.2
bootstrap-datepicker^1.10.1
bootstrap-material-datetimepickerbitbucket:metasolutions/bootstrap-material-datetimepicker#webpack
bootstrap-material-design^4.1.3
circular-dependency-plugin^5.2.2
core-js^3.46.0
ifdef-loader^2.3.2
jquery^3.7.1
jquery-mousewheel^3.2.2
lodash-es^4.17.21
moment^2.30.1
nls-loaderbitbucket:metasolutions/nls-loader#master
node-fetch^2.7.0
popper.js^1.16.1
react^18.3.1
react-dom^18.3.1
react-hooks-lib^0.1.5
regenerator-runtime^0.13.11
select24.0.8
sizzle^2.3.10
terser-webpack-plugin^5.3.14
whatwg-fetch^3.6.20