Package evidence

@factorialco/[email protected]

Large Javascript Payload: 2345365 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 142,893Ubiquitous · −70% score
Versions published: 656Established · −30% score
First published: Sep 2025
Publisher: eliseo_jq

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@factorialco/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@factorialco/[email protected]"],"fail_on":"review"}'

Publishereliseo_jq

Artifact bytes4,432,311

Previous version3.6.0

Published2026-06-17T16:16:01.683Z

SHA-25672e8d874972638fcff58a896cec60b47e3e465268181640f49a125fd569f2093

Why flagged

What the scanner saw

Large Javascript Payload: 2345365 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

14h agoLast checked

lowRisk

0Score

3.7.0Version

Status history (1 event)

new → available14h ago · risk low · score 0 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail
low	Large Javascript Payload	package/dist/f0.js	2345365 bytes
low	Large Javascript Payload	package/dist/F0CanvasPanel-DfmThuOg.js	5806321 bytes
low	Large Javascript Payload	package/dist/useDataCollectionSource-MryiHA0V.js	2663089 bytes

Manifest

Package metadata

Scripts34

buildtsc --project ./tsconfig-build.json && run-p build-icons && NODE_OPTIONS=--max-old-space-size=8192 BUILD_TYPES=true vite build -- --tailwind
build-apipnpm --dir api install --ignore-workspace && pnpm --dir api run build
build-iconstsc --project ./tsconfig-build-icons.json
build-storybookstorybook build
build:preparepnpm run build:types && run-p build-icons
build:tailwindNODE_ENV=production tailwindcss -i src/styles.css -o ./dist/styles.css --postcss --minify
build:tsuptsup && pnpm run build:tailwind && run-p build-icons
build:typestsc --project ./tsconfig-build.json
build:watchpnpm build --watch
check:api-surfacetsx .scripts/check-api-surface.ts
cycle-deps:deltatsx --tsconfig tsconfig.node.json .scripts/check-cycle-dependencies.ts
devstorybook dev -p 6006
dev:docsDOCS_MODE=true pnpm run dev
dev:syncpnpm build:prepare && tsx scripts/dev-sync.ts
formatsh -c 'oxfmt "${@:-src/}"' --
format:checksh -c 'oxfmt --check "${@:-src/}"' --
generate-ai-iconsnpx @svgr/cli --out-dir src/icons/ai node_modules/@factorialco/f0-core/assets/icons/ai
generate-app-iconsnpx @svgr/cli --out-dir src/icons/app node_modules/@factorialco/f0-core/assets/icons/app
generate-flag-iconsnpx @svgr/cli --out-dir src/flags/components node_modules/@factorialco/f0-core/assets/flags
generate-icon-barrelsbash scripts/generate-icon-barrels.sh src/icons/app src/icons/modules src/icons/ai src/flags/components
generate-iconsrm -fR src/icons/app/* src/icons/modules/* src/flags/components/* src/icons/ai/* && run-p generate-app-icons generate-module-icons generate-flag-icons generate-ai-icons && oxfmt "src/{icons,flags}/**/*.tsx" && pnpm generate-icon-barrels
generate-module-iconsnpx @svgr/cli --out-dir src/icons/modules node_modules/@factorialco/f0-core/assets/icons/modules
lintsh -c 'oxlint "${@:-src/**/*}" --max-warnings 0' --
lint:fixsh -c 'oxlint "${@:-src/**/*}" --fix --max-warnings 0' --
previewvite preview
serve-storybookhttp-server storybook-static
sizepnpm run build && size-limit
startpnpm run dev
test-storybooktest-storybook --testTimeout=60000
tsctsc --noEmit
…and 4 more.

Dependencies85

@atlaskit/pragmatic-drag-and-drop^1.7.4
@atlaskit/pragmatic-drag-and-drop-flourish^2.0.4
@atlaskit/pragmatic-drag-and-drop-hitbox^1.1.0
@atlaskit/pragmatic-drag-and-drop-react-drop-indicator^3.2.10
@dnd-kit/core^6.3.1
@dnd-kit/sortable^10.0.0
@dnd-kit/utilities^3.2.2
@factorialco/f0-core1.53.0
@radix-ui/number^1.1.1
@radix-ui/primitive^1.1.2
@radix-ui/react-collection^1.1.7
@radix-ui/react-compose-refs^1.1.2
@radix-ui/react-context^1.1.3
@radix-ui/react-direction^1.1.1
@radix-ui/react-dismissable-layer^1.1.10
@radix-ui/react-focus-guards^1.1.2
@radix-ui/react-focus-scope^1.1.7
@radix-ui/react-hover-card^1.1.15
@radix-ui/react-id^1.1.1
@radix-ui/react-popper^1.2.7
@radix-ui/react-portal^1.1.9
@radix-ui/react-primitive^2.1.3
@radix-ui/react-slider^1.3.6
@radix-ui/react-switch^1.2.6
@radix-ui/react-use-callback-ref^1.1.1
@radix-ui/react-use-controllable-state^1.2.2
@radix-ui/react-use-layout-effect^1.1.1
@radix-ui/react-use-previous^1.1.1
@radix-ui/react-visually-hidden^1.2.3
@reactuses/core^6.1.5
…and 55 more.

Optional dependencies1

@rollup/rollup-linux-x64-gnu^4.34