Package evidence

@exodus/[email protected]

Remote Dependency Spec: devDependencies.@types/exodus__secp256k1="https://registry.npmjs.org/@types/secp256k1/-/secp256k1-4.0.3.tgz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 48Mature · −50% score
First published: Nov 2020
Publisher: florianmathieu

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@exodus/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@exodus/[email protected]"],"fail_on":"review"}'

Publisherflorianmathieu

Artifact bytes108,804

Previous version1.63.1-exodus.9-rc3

Published2024-10-10T14:40:44.003Z

SHA-256a7de6ca3e9420b699631b769aeb30c4d68ed9f95a6679787154c6116f0fce483

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.@types/exodus__secp256k1="https://registry.npmjs.org/@types/secp256k1/-/secp256k1-4.0.3.tgz"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

4d agoLast checked

reviewRisk

4Score

1.63.1-exodus.9-rc4Version

Status history (1 event)

new → available4d ago · risk review · score 4 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.@types/exodus__secp256k1="https://registry.npmjs.org/@types/secp256k1/-/secp256k1-4.0.3.tgz"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.@types/exodus__secp256k1	https://registry.npmjs.org/@types/secp256k1/-/secp256k1-4.0.3.tgz	low	0	no remote findings

Manifest

Package metadata

Scripts17

buildnpm run clean; cross-env NODE_ENV=production rollup -c; npx tsc -p tsconfig.d.json -d
build:fixturesset -ex; ./test/fixtures/noop-program/build.sh
cleanrimraf ./coverage ./lib
codecovset -ex; npm run test:cover; cat ./coverage/lcov.info | codecov
devcross-env NODE_ENV=development rollup -c
docset -ex; typedoc --treatWarningsAsErrors
lintset -ex; npm run pretty; eslint . --ext .js,.ts
lint:fixnpm run pretty:fix && eslint . --fix --ext .js,.ts
okrun-s lint test doc type:check
prettyprettier --check '{,{src,test}/**/}*.{j,t}s'
pretty:fixprettier --write '{,{src,test}/**/}*.{j,t}s'
resemantic-release --repository-url [email protected]:solana-labs/solana-web3.js.git
testcross-env TS_NODE_COMPILER_OPTIONS='{ "module": "commonjs", "target": "es2019" }' ts-mocha --require esm './test/**/*.test.ts'
test:covernyc --reporter=lcov npm run test
test:liveTEST_LIVE=1 npm run test
test:live-with-test-validatorstart-server-and-test 'solana-test-validator --reset --quiet' http://localhost:8899/health test:live
type:checktsc -p tsconfig.json --noEmit

Dependencies17

@babel/runtime^7.12.5
@exodus/fetch^1.2.1
@exodus/js-sha3^0.6.1-exodus1
@noble/secp256k1^1.6.3
@solana/buffer-layout^4.0.0
bigint-buffer^1.1.5
bn.js^5.0.0
borsh^0.7.0
bs58^4.0.1
buffer^6.0.1
create-hmac^1.1.7
jayson^3.4.4
json-stable-stringify^1.0.1
node-fetch2
sha.js^2.4.11
superstruct^0.14.2
tweetnacl^1.0.0