Package evidence

@howdygo/[email protected]

Install-time lifecycle script: prepare="npm run prepack"

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@howdygo/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@howdygo/[email protected]"],"fail_on":"review"}'

Publisherhowdygo

Artifact bytes1,361,755

Previous version2.0.0-alpha.43

Published2026-03-16T02:49:08.845Z

SHA-25636e5b00992aedda2350cf791b6bc61789e4f708634120d7e01ab8fff88e075a7

Why flagged

What the scanner saw

Install-time lifecycle script: prepare="npm run prepack"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

16Score

2.0.0-alpha.44Version

Status history (1 event)

new → available19d ago · risk review · score 16 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 5 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	prepare="npm run prepack"	4
low	Obfuscation	package/dist/rrweb.cjs	matched "\\u000c"	3
low	Obfuscation	package/dist/rrweb.umd.cjs	matched "\\u000c"	3
low	Obfuscation	package/dist/rrweb.umd.min.cjs	matched "\\u000c"	3
low	Obfuscation	package/dist/rrweb.js	matched "\\u000c"	3

Manifest

Package metadata

Scripts19

benchmarkvitest run --maxConcurrency 1 --no-file-parallelism test/benchmark
buildyarn turbo run prepublish
build-and-testyarn build && yarn retest
check-typestsc -noEmit
devvite build --watch
lintyarn eslint src
live-streamyarn build && node scripts/stream.js
prepacknpm run build
preparenpm run prepack
prepublishtsc -noEmit && vite build
replyarn build && node scripts/repl.js
retestcross-env PUPPETEER_HEADLESS=true yarn retest:headful
retest:headfulvitest run --exclude test/benchmark
retest:updatecross-env PUPPETEER_HEADLESS=true yarn retest --update
testyarn test:headless
test:headfulcross-env PUPPETEER_HEADLESS=false yarn build-and-test
test:headlesscross-env PUPPETEER_HEADLESS=true yarn build-and-test
test:updateyarn test:headless --update
test:watchyarn build && cross-env PUPPETEER_HEADLESS=true yarn vitest --exclude test/benchmark

Dependencies8

@howdygo/rrdom^2.0.0-alpha.44
@howdygo/rrweb-snapshot^2.0.0-alpha.44
@howdygo/rrweb-types^2.0.0-alpha.44
@howdygo/rrweb-utils^2.0.0-alpha.44
@types/css-font-loading-module0.0.7
@xstate/fsm^1.4.0
base64-arraybuffer^1.0.1
mitt^3.0.0