Package evidence

@janefeel3/[email protected]

Remote Dependency Spec: devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 6
First published: May 2026
Publisher: janefeel3

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@janefeel3/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@janefeel3/[email protected]"],"fail_on":"review"}'

Publisherjanefeel3

Artifact bytes17,845,623

Previous version2.35.26

Published2026-05-07T13:01:53.168Z

SHA-256f9984a444c0dfbc5f7cb95340533c7945161bea2f1b4ff94e1b42a67e22570ec

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

12h agoLast checked

reviewRisk

8Score

2.35.27Version

Status history (1 event)

new → available12h ago · risk review · score 8 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"	8

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"	8
low	Large Javascript Payload	package/dist/iD.js	4080536 bytes	0
low	Large Javascript Payload	package/dist/iD.min.js	2152312 bytes	0

Manifest

Package metadata

Scripts30

allrun-s clean build dist
buildrun-s build:css build:data build:js
build:cssnode scripts/build_css.js
build:datashx mkdir -p dist/data && node scripts/build_data.js
build:jsnode config/esbuild.config.mjs
build:js:watchnode config/esbuild.config.mjs --watch
build:statsnode config/esbuild.config.mjs --stats && esbuild-visualizer --metadata dist/esbuild.json --exclude *.png --filename docs/statistics.html && shx rm dist/esbuild.json
cleanshx rm -f dist/esbuild.json dist/*.js dist/*.map dist/*.css dist/img/*.svg
distrun-p dist:**
dist:mapillaryshx mkdir -p dist/mapillary-js && shx cp -R node_modules/mapillary-js/dist/* dist/mapillary-js/
dist:minnode config/esbuild.config.min.mjs
dist:pannellumshx mkdir -p dist/pannellum && shx cp -R node_modules/pannellum/build/* dist/pannellum/
dist:svg:communitysvg-sprite --symbol --symbol-dest . --shape-id-generator "community-%s" --symbol-sprite dist/img/community-sprite.svg node_modules/osm-community-index/dist/img/*.svg
dist:svg:fasvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/fa-sprite.svg svg/fontawesome/*.svg
dist:svg:iDsvg-sprite --symbol --symbol-dest . --shape-id-generator "iD-%s" --symbol-sprite dist/img/iD-sprite.svg "svg/iD-sprite/**/*.svg"
dist:svg:makisvg-sprite --symbol --symbol-dest . --shape-id-generator "maki-%s" --symbol-sprite dist/img/maki-sprite.svg node_modules/@mapbox/maki/icons/*.svg
dist:svg:mapillary:objectssvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/mapillary-object-sprite.svg node_modules/@rapideditor/mapillary_sprite_source/package_objects/*.svg
dist:svg:mapillary:signssvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/mapillary-sprite.svg node_modules/@rapideditor/mapillary_sprite_source/package_signs/*.svg
dist:svg:roentgensvg-sprite --shape-id-generator "roentgen-%s" --shape-dim-width 16 --shape-dim-height 16 --symbol --symbol-dest . --symbol-sprite dist/img/roentgen-sprite.svg svg/roentgen/*.svg
dist:svg:temakisvg-sprite --symbol --symbol-dest . --shape-id-generator "temaki-%s" --symbol-sprite dist/img/temaki-sprite.svg node_modules/@rapideditor/temaki/icons/*.svg
imagerynode scripts/update_imagery.js
linteslint config scripts test/spec modules
lint:fixeslint scripts test/spec modules --fix
startrun-s start:watch
start:servernode scripts/server.js
start:single-buildrun-p build:js start:server
start:watchrun-p build:js:watch start:server
testnpm-run-all -s lint build test:spec
test:specvitest --no-isolate
translationsnode scripts/update_locales.js

Dependencies27

@mapbox/geojson-area^0.2.2
@mapbox/sexagesimal1.2.0
@mapbox/vector-tile^2.0.4
@rapideditor/country-coder~5.4.0
@rapideditor/location-conflation~1.5.0
@tmcw/togeojson^7.1.2
@turf/bbox^7.2.0
@turf/bbox-clip^7.2.0
abortcontroller-polyfill^1.7.8
aes-js^3.1.2
alif-toolkit^1.3.0
core-js-bundle^3.43.0
diacritics1.3.0
exifr^7.1.3
fast-deep-equal~3.1.1
fast-json-stable-stringify2.1.0
lodash-es~4.17.15
marked~16.0.0
node-diff3~3.1.0
osm-auth~2.6.0
pannellum2.5.6
pbf^4.0.1
polygon-clipping~0.15.7
rbush4.0.1
vitest^3.2.4
whatwg-fetch^3.6.20
which-polygon2.2.1