Package evidence

@hyperledger-cacti/[email protected]

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 12 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 81
Versions published: 1
First published: Jun 2026
Publisher: lfdt-npm

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@hyperledger-cacti/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@hyperledger-cacti/[email protected]"],"fail_on":"review"}'

Publisherlfdt-npm

Artifact bytes9,012

Previous versionnone

Published2026-06-12T17:18:10.147Z

SHA-2562bec3ed93b5bb3ed159529c326a5a82a62d728dad145a93c521603e800a33a5b

Why flagged

What the scanner saw

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 12 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

6h agoLast checked

reviewRisk

15Score

3.0.0-alpha.5Version

Status history (1 event)

new → available6h ago · risk review · score 15 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Manifest Codeless Dependency Stub	package.json	package ships no JS/TS source but declares 12 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape	15

Manifest

Package metadata

Scripts13

buildyarn clean-build && yarn compile && yarn copy-templates && yarn copy-data && yarn copy-config && yarn copy-basic-wallets && yarn copy-credentials
clean-buildrm -rf ./build
compiletsc -p .
copy-basic-walletscp -a ./src/wallet-network1 ./build/ && cp -a ./src/wallet-network2 ./build/
copy-config[ -f ./config.json ] && cp ./config.json ./build/ || true
copy-credentials[ -d ./src/credentials ] && cp -a ./src/credentials ./build/ || true
copy-data[ -d ./src/data ] && cp -a ./src/data ./build/ || true
copy-templates[ -f ./src/templates ] && cp -a ./src/templates ./build/ || true
coveragejest --coverage
prepublishOnlyyarn build
snapupdatejest --updateSnapshot
testjest
watchjest --watch

Dependencies12

@fidm/x5091.2.1
@hyperledger-cacti/cacti-weaver-protos-js3.0.0-alpha.5
@hyperledger-cacti/cacti-weaver-sdk-fabric3.0.0-alpha.5
body-parser1.20.3
dotenv8.6.0
express5.1.0
fabric-ca-client2.2.20
fabric-common2.2.20
fabric-network2.2.20
gluegun5.1.6
uuid10.0.0
winston3.10.0