PkgRadar

Package evidence

@hubspot/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
21,487Mainstream · −50% score
Versions published
496Mature · −50% score
First published
Jan 2021
Publisher
chiragchadha

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@hubspot/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@hubspot/[email protected]"],"fail_on":"review"}'
Publisherchiragchadha
Artifact bytes372,299
Previous version8.1.3-experimental.0
Published2026-05-28T16:17:08.413Z
SHA-256e31db8f02cd04c8b09596acb07a4ff89683a04475cfce87c8c6919116aef4567

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
8.1.4-experimental.0Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts25
  • buildtsx ./scripts/build.ts
  • build-dockerdocker image build --tag hs-cli-image . && docker image prune -f
  • circular-depsyarn madge --circular .
  • debug-mcpyarn build && npx --yes @modelcontextprotocol/inspector node dist/mcp-server/server.js
  • hsyarn build && node ./dist/bin/hs
  • hs-debugyarn build && NODE_DEBUG=http* node --inspect-brk ./dist/bin/hs
  • hs-proxyyarn build && HTTPS_PROXY=http://localhost:8181 NODE_TLS_REJECT_UNAUTHORIZED=0 node ./dist/bin/hs
  • ink-playgroundyarn build && yarn tsx ./scripts/ink-playground.ts
  • lintecho 'Linting is disabled for Blazar'
  • lint:localeslint . && prettier --list-different './**/*.{ts,tsx,js,json}'
  • list-all-commandsyarn tsx ./scripts/get-all-commands.ts
  • local-linkhubspot-linking
  • mcp-localyarn tsx ./scripts/mcp-local.ts
  • prettier:writeprettier --write './**/*.{ts,js,json,tsx}'
  • releaseyarn tsx ./scripts/release.ts release
  • sync-to-publicyarn tsx ./scripts/sync-to-public.ts repo-sync
  • testvitest run --coverage
  • test-cliyarn build && yarn --cwd 'acceptance-tests' test-ci
  • test-cli-debugyarn build && yarn --cwd 'acceptance-tests' test-debug
  • test-cli-latestyarn build && yarn build-docker && docker container run -it --rm --name=hs-cli-container hs-cli-image yarn --cwd 'acceptance-tests' test-latest
  • test-cli-qayarn build && yarn --cwd 'acceptance-tests' test-qa
  • test-cli-qa-debugyarn build && yarn --cwd 'acceptance-tests' test-qa-debug
  • test-devvitest
  • update-ldlyarn add --exact @hubspot/local-dev-lib@latest
  • view-unreleased-changesnode ./scripts/unreleasedChanges.js
Dependencies30
  • @hubspot/local-dev-lib5.7.1
  • @hubspot/project-parsing-lib0.16.0
  • @hubspot/serverless-dev-runtime7.0.7
  • @hubspot/ui-extensions-dev-server2.0.7
  • @inquirer/prompts7.1.0
  • @modelcontextprotocol/sdk1.29.0
  • archiver7.0.1
  • chalk5.4.1
  • chokidar3.6.0
  • cli-cursor3.1.0
  • cli-progress3.12.0
  • express4.22.1
  • findup-sync4.0.0
  • fs-extra8.1.0
  • ink6.6.0
  • ink-spinner5.0.0
  • ink-text-input6.0.0
  • js-yaml4.1.1
  • minimatch10.2.5
  • moment2.30.1
  • open7.4.2
  • p-queue8.1.0
  • react19.2.3
  • strip-ansi7.1.0
  • table6.9.0
  • tmp0.2.4
  • update-notifier7.3.1
  • ws8.20.0
  • yargs17.7.2
  • yargs-parser21.1.1