Package evidence

@gbasin/[email protected]

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 27 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 222
Versions published: 61
First published: Feb 2026
Publisher: gbasin

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@gbasin/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@gbasin/[email protected]"],"fail_on":"review"}'

Publishergbasin

Artifact bytes7,466

Previous version0.2.47

Published2026-05-26T15:10:34.959Z

SHA-256631f186b74e4989cde5a81664cd0be435c40a11984e2181ea2e366c9d4a4e8cf

Why flagged

What the scanner saw

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 27 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

14h agoLast checked

reviewRisk

15Score

0.2.48Version

Status history (1 event)

new → available14h ago · risk review · score 15 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Manifest Codeless Dependency Stub	package.json	package ships no JS/TS source but declares 27 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape	15

Manifest

Package metadata

Scripts19

buildvite build
coverage:allbun scripts/coverage-all.ts
deps:riskbun scripts/dependency-risk.ts
deps:risk:cibun scripts/dependency-risk.ts --threshold critical
deps:risk:jsonbun scripts/dependency-risk.ts --json
devconcurrently -k "bun run dev:server" "bun run dev:client"
dev:clientvite --host
dev:serverbun scripts/dev-server.ts
lintoxlint .
preparegit config core.hooksPath .githooks
release:majorbun scripts/release.ts major
release:minorbun scripts/release.ts minor
release:patchbun scripts/release.ts patch
startbun src/server/index.ts
testbun scripts/test-runner.ts
test:coveragebun scripts/test-runner.ts --coverage --coverage-reporter=lcov --skip-isolated && bun run coverage:all
test:e2eplaywright test
test:e2e:headedplaywright test --headed
typechecktsc --noEmit

Dependencies23

@base-ui/react^1.2.0
@dnd-kit/core^6.3.1
@dnd-kit/sortable^10.0.0
@dnd-kit/utilities^3.2.2
@fontsource-variable/jetbrains-mono^5.2.8
@untitledui-icons/react^1.0.3
@xterm/addon-clipboard^0.2.0
@xterm/addon-fit^0.11.0
@xterm/addon-progress^0.1.0
@xterm/addon-search^0.15.0
@xterm/addon-serialize^0.14.0
@xterm/addon-web-links^0.12.0
@xterm/addon-webgl^0.18.0
@xterm/xterm^5.5.0
clsx^2.1.1
hono^4.6.10
motion^12.25.0
node-pty^1.1.0
pino^10.3.0
react^18.3.1
react-dom^18.3.1
tailwind-merge^3.4.0
zustand^5.0.0

Optional dependencies4

@gbasin/agentboard-darwin-arm640.2.48
@gbasin/agentboard-darwin-x640.2.48
@gbasin/agentboard-linux-arm640.2.48
@gbasin/agentboard-linux-x640.2.48