PkgRadar

Package evidence

@esri/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1,990Mature · −50% score
First published
Aug 2019
Publisher
jcfranco

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@esri/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@esri/[email protected]"],"fail_on":"review"}'
Publisherjcfranco
Artifact bytes2,757,519
Previous version5.1.2-next.1
Published2026-06-12T17:59:50.736Z
SHA-2561b355b5a0fa7cefd2475df5b75337ae007cbe305351d7cce8d4e242c19f861b7

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
5.1.2-next.2Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts36
  • buildnpm run util:prep-build-reqs && vite build
  • build-storybooknpm run util:prep-build-reqs && NODE_OPTIONS=--openssl-legacy-provider storybook build --output-dir ./docs --quiet
  • build:devvite build --mode development
  • build:watchnpm run util:prep-build-reqs && vite --mode production
  • build:watch-devnpm run util:prep-build-reqs && vite --mode development
  • cleannpm run util:clean-js-files && rimraf node_modules dist docs .turbo
  • lintconcurrently npm:lint:*
  • lint:htmlprettier --ignore-path "../../.prettierignore" --write "**/*.html" >/dev/null
  • lint:jsonprettier --ignore-path "../../.prettierignore" --write "**/*.json" >/dev/null
  • lint:mdprettier --ignore-path "../../.prettierignore" --write "**/*.md" >/dev/null && markdownlint-cli2 "**/*.md" --fix --config "../../.markdownlint-cli2.jsonc"
  • lint:scssstylelint --fix "src/**/*.scss" && prettier --ignore-path "../../.prettierignore" --write "**/*.scss" >/dev/null
  • lint:tseslint --fix && prettier --ignore-path "../../.prettierignore" --write "**/*.{ts,tsx,cjs,mjs}" >/dev/null
  • postbuildnpm run util:generate-t9n-docs-json && npm run util:generate-supported-browsers-json
  • screenshot-testsnpm run build-storybook
  • screenshot-tests:previewnpm run util:prep-build-reqs && NODE_OPTIONS=--openssl-legacy-provider STORYBOOK_SCREENSHOT_LOCAL_BUILD=true storybook dev
  • screenshot-tests:publishnpm run screenshot-tests && storybook-to-ghpages --existing-output-dir=docs
  • startnpm run util:clean-js-files && concurrently --kill-others --raw "trap 'npm run util:clean-js-files' INT TERM EXIT >/dev/null 2>&1 || true && tsc --project ./tsconfig.demos.json --watch" "npm run build:watch-dev"
  • testconcurrently --passthrough-arguments "npm:test:node -- {@}" "npm:test:browser -- {@}" --
  • test:browsernpm run util:install-playwright && BROWSER_TESTS=true vitest run
  • test:ciconcurrently --passthrough-arguments --names node,browser "npm run test:node 2>test-node.err.log" "npm run test:browser 2>test-browser.err.log" || node ./support/log-test-output.mts
  • test:nodevitest run
  • test:watchconcurrently --passthrough-arguments "npm run test:watch:node -- {@}" "npm run test:watch:browser -- {@}" --
  • test:watch:browsernpm run util:install-playwright && BROWSER_TESTS=true vitest watch
  • test:watch:nodevitest watch
  • util:add-internal-custom-css-prop-docnode support/add-internal-custom-prop-doc.ts
  • util:clean-js-filesrimraf --glob -- *.js {src,.storybook,support}/**/*.js
  • util:clean-tested-buildnpm ci && npm test && npm run build
  • util:copy-assetsnpm run util:copy-icons
  • util:copy-iconscpy "../ui-icons/js/*.json" "src/components/icon/assets/" --flat
  • util:generate-supported-browsers-jsonnode support/generate-supported-browsers-json.ts
  • …and 6 more.
Dependencies15
  • @arcgis/lumina>=5.1.0-next.96 <6.0.0
  • @arcgis/toolkit>=5.1.0-next.96 <6.0.0
  • @esri/calcite-ui-icons4.6.0-next.4
  • @floating-ui/dom^1.6.12
  • @floating-ui/utils^0.2.8
  • @types/sortablejs^1.15.8
  • color^5.0.3
  • composed-offset-position^0.0.6
  • es-toolkit^1.39.8
  • focus-trap^8.2.1
  • interactjs^1.10.27
  • lit^3.3.0
  • sortablejs^1.15.6
  • timezone-groups^0.10.4
  • type-fest^4.30.1