Package evidence

@fibery/[email protected]

Remote Dependency Spec: dependencies.apcach="github:antiflasher/apcach#54077b3"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 210
Versions published: 119Mature · −50% score
First published: Jun 2022
Publisher: mike-yermolayev

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@fibery/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@fibery/[email protected]"],"fail_on":"review"}'

Publishermike-yermolayev

Artifact bytes851,065

Previous version4.0.0

Published2026-06-02T14:48:33.317Z

SHA-256b150f347bf1b44d435bfd3586c5452c282f3958bd5a944143546ea7e179c3957

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.apcach="github:antiflasher/apcach#54077b3"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

11d agoLast checked

reviewRisk

6Score

4.1.0Version

Status history (1 event)

new → available11d ago · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.apcach="github:antiflasher/apcach#54077b3"	12

Manifest

Package metadata

Scripts8

check../../scripts/check.sh
generate-iconsnode scripts/generate-icons.mjs
lintpnpm -w lint .
show-colorscd ../.. && SHOW_COLORS=1 ./node_modules/.bin/vitest run --project ui-kit --disable-console-intercept -t 'show all current colors'
test../../scripts/test.sh
test:ci../../scripts/test.sh --ci
test:coverage../../scripts/test.sh --ci --coverage
typecheck../../scripts/typecheck.sh

Dependencies58

@fibery/emoji-data2.7.3
@fibery/helpers3.1.0
@fibery/react1.5.4
@linaria/core7.0.0
@linaria/react7.0.1
@popperjs/core2.11.6
@radix-ui/react-collapsible1.1.0
@radix-ui/react-context-menu2.2.1
@radix-ui/react-dropdown-menu2.1.1
@radix-ui/react-focus-scope1.1.8
@radix-ui/react-navigation-menu1.2.1
@radix-ui/react-slot1.2.4
@radix-ui/react-toast1.2.2
@radix-ui/react-toggle1.1.10
@radix-ui/react-toggle-group1.1.11
@radix-ui/react-tooltip1.1.3
@tanstack/hotkeys0.7.1
@tanstack/react-hotkeys0.9.1
@types/apca-w30.1.3
@types/d3-shape3.1.6
@types/react-select-country-list2.2.3
@types/setimmediate1.0.4
apca-w30.1.9
apcachgithub:antiflasher/apcach#54077b3
chrono-node2.9.0
classnames2.3.1
cmdk1.0.0
color-hash1.0.3
culori4.0.2
d3-shape1.3.7
…and 28 more.