Package evidence

@firfi/[email protected]

Large Javascript Payload: 7586762 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,951Niche · −30% score
Versions published: 91
First published: Feb 2026
Publisher: firfi

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@firfi/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@firfi/[email protected]"],"fail_on":"review"}'

Publisherfirfi

Artifact bytes1,538,927

Previous version0.18.1

Published2026-05-29T04:03:49.407Z

SHA-25608e62bb2a600bd5098b3dd0bc615e079a6af656a38279662dc6bcd2630676108

Why flagged

What the scanner saw

Large Javascript Payload: 7586762 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

15d agoLast checked

lowRisk

0Score

0.18.2Version

Status history (2 events)

new → available15d ago · risk low · score 0 · status changed
new → available15d ago · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/dist/index.cjs	7586762 bytes	0

Manifest

Package metadata

Scripts17

buildPKG_VERSION=$(node -p "require('./package.json').version") && esbuild src/index.ts --bundle --platform=node --format=cjs --outfile=dist/index.cjs --external:ws "--define:PKG_VERSION=\"$PKG_VERSION\""
check-allpnpm build && pnpm typecheck && pnpm verify-registry-metadata && pnpm lint && pnpm test
check-formatfind src test -name '*.ts' -print0 | xargs -0 eslint --rule '@effect/dprint: error'
circularmadge --extensions ts --circular src
formatfind src test -name '*.ts' -print0 | xargs -0 eslint --fix --rule '@effect/dprint: error'
lintfind src test -name '*.ts' -print0 | xargs -0 eslint && jscpd src
lint:fixfind src test -name '*.ts' -print0 | xargs -0 eslint --fix
local-releasepnpm dlx @changesets/[email protected] version && pnpm sync-registry-metadata && git add package.json CHANGELOG.md server.json .changeset && (git diff --cached --quiet || HUSKY=0 git commit -m "RELEASING: Releasing 1 package(s)") && PKG_VERSION=$(node -p "require('./package.json').version") && pnpm dlx [email protected] src/index.ts --bundle --platform=node --format=cjs --outfile=dist/index.cjs --external:ws "--define:PKG_VERSION=\"$PKG_VERSION\"" && pnpm verify-version && npm_config_ignore_scripts=true pnpm dlx @changesets/[email protected] publish
startnode dist/index.cjs
sync-registry-metadatanode scripts/sync-registry-metadata.mjs
testvitest run
test:coveragevitest run --coverage
test:watchvitest
typechecktsc -p tsconfig.json --noEmit 2>&1 | { grep -E '^(src/|test/)' && exit 1 || exit 0; }
update-readmetsx scripts/update-readme-tools.mjs
verify-registry-metadatanode scripts/sync-registry-metadata.mjs --check
verify-versionnode -e "const v=require('./package.json').version; const d=require('fs').readFileSync('dist/index.cjs','utf8'); if(!d.includes('\"'+v+'\"'))throw new Error('dist version mismatch: expected '+v)"

Dependencies1

ws^8.18.0