PkgRadar

Package evidence

@gnsx/[email protected]

Large Javascript Payload: 2076302 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,053Niche · −30% score
Versions published
12
First published
May 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@gnsx/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@gnsx/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes12,685,233
Previous version0.184.9
Published2026-05-22T14:23:57.115Z
SHA-256d853c8b81a132a4f2f10989b129af89939ce3f1cb9ee9c825b0ed633e73dde35

Why flagged

What the scanner saw

Large Javascript Payload: 2076302 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
9Score
0.184.10Version
Status history (1 event)
  1. new → available · risk review · score 9 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/build/three.cjs2076302 bytes10
mediumLarge Javascript Payloadpackage/build/three.webgpu.js2080485 bytes10
mediumLarge Javascript Payloadpackage/build/three.webgpu.nodes.js2072179 bytes10

Manifest

Package metadata

Scripts24
  • buildrollup -c utils/build/rollup.config.js
  • build-docsjsdoc -c utils/docs/jsdoc.config.json && npm run build-llms
  • build-llmsnode utils/llms/build.js
  • build-modulerollup -c utils/build/rollup.config.js --configOnlyModule
  • devnode utils/build/dev.js && node utils/server.js -p 8080
  • lintnpm run lint-core
  • lint-addonseslint examples/jsm
  • lint-coreeslint src
  • lint-editoreslint editor
  • lint-exampleseslint examples
  • lint-fixnpm run lint-core -- --fix && npm run lint-addons -- --fix && npm run lint-examples -- --fix && npm run lint-editor -- --fix && npm run lint-manual -- --fix && npm run lint-test -- --fix && npm run lint-utils -- --fix
  • lint-manualeslint manual
  • lint-testeslint test
  • lint-utilseslint utils
  • make-screenshotnode test/e2e/puppeteer.js --make
  • previewnode utils/build/preview.js
  • startnpm run dev
  • testnpm run lint && npm run test-unit && npm run test-unit-addons
  • test-e2enode test/e2e/puppeteer.js
  • test-e2e-covnode test/e2e/check-coverage.js
  • test-e2e-webgpunode test/e2e/puppeteer.js --webgpu
  • test-treeshakerollup -c test/rollup.treeshake.config.js
  • test-unitqunit test/unit/three.source.unit.js
  • test-unit-addonsqunit test/unit/three.addons.unit.js