Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 106
- First published
- Feb 2026
- Publisher
- firfi
Recommended action
Looks clean — keep monitoringNo high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@firfi/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@firfi/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Large Javascript Payload: 8104782 bytes
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk low · score 0 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 1 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Large Javascript Payload | package/dist/index.cjs | 8104782 bytes | 0 |
Manifest
Package metadata
Scripts19
buildPKG_VERSION=$(node -p "require('./package.json').version") && esbuild src/index.ts --bundle --platform=node --format=cjs --outfile=dist/index.cjs --external:ws "--define:PKG_VERSION=\"$PKG_VERSION\""check-allpnpm build && pnpm typecheck && pnpm circular && pnpm verify-registry-metadata && pnpm verify-sdk-parity && pnpm verify-readme && pnpm lint && pnpm test:coveragecheck-formatfind src test -name '*.ts' -print0 | xargs -0 eslint --rule '@effect/dprint: error'circularmadge --extensions ts --circular srcformatfind src test -name '*.ts' -print0 | xargs -0 eslint --fix --rule '@effect/dprint: error'lintfind src test -name '*.ts' -print0 | xargs -0 eslint && jscpd srclint:fixfind src test -name '*.ts' -print0 | xargs -0 eslint --fixlocal-releasepnpm dlx @changesets/[email protected] version && pnpm sync-registry-metadata && git add package.json CHANGELOG.md server.json .changeset && (git diff --cached --quiet || HUSKY=0 git commit -m "RELEASING: Releasing 1 package(s)") && PKG_VERSION=$(node -p "require('./package.json').version") && pnpm dlx [email protected] src/index.ts --bundle --platform=node --format=cjs --outfile=dist/index.cjs --external:ws "--define:PKG_VERSION=\"$PKG_VERSION\"" && pnpm verify-version && npm_config_ignore_scripts=true pnpm dlx @changesets/[email protected] publishstartnode dist/index.cjssync-registry-metadatanode scripts/sync-registry-metadata.mjstestvitest runtest:coveragevitest run --coveragetest:watchvitesttypechecktsc -p tsconfig.json --noEmit 2>&1 | { grep -E '^(src/|test/)' && exit 1 || exit 0; }update-readmetsx scripts/update-readme-tools.mjsverify-readmetsx scripts/update-readme-tools.mjs --checkverify-registry-metadatanode scripts/sync-registry-metadata.mjs --checkverify-sdk-paritynode scripts/audit-sdk-parity.mjsverify-versionnode -e "const v=require('./package.json').version; const d=require('fs').readFileSync('dist/index.cjs','utf8'); if(!d.includes('\"'+v+'\"'))throw new Error('dist version mismatch: expected '+v)"
Dependencies1
ws^8.18.0