Package evidence

@jitsi/[email protected]

Remote Dependency Spec: dependencies.lib-jitsi-meet="https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 48Mature · −50% score
First published: Jul 2023
Publisher: calinteodor

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@jitsi/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@jitsi/[email protected]"],"fail_on":"high"}'

Publishercalinteodor

Artifact bytes10,282,287

Previous version12.0.0

Published2026-04-20T09:06:45.088Z

SHA-256b35f41dd19faedb0e428eb4506e3fd2bf4d7079cb13b1572dbeb8eff05783682

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.lib-jitsi-meet="https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"

2 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

13h agoLast checked

highRisk

41Score

12.1.0Version

Status history (1 event)

new → available13h ago · risk high · score 41 · status changed

Evidence

Static findings

3 static · 1 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.lib-jitsi-meet="https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"	12
high	Remote Dependency Spec	package.json	dependencies.react-native-dialog="https://github.com/jitsi/react-native-dialog/releases/download/v9.2.2-jitsi.1/react-native-dialog-9.2.2.tgz"	12
high	Dependency Changed To Remote Vs Previous	package.json	dependencies.lib-jitsi-meet changed to remote spec in 12.1.0 vs 12.0.0: "https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"	12

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.lib-jitsi-meet="https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"	12
high	Remote Dependency Spec	package.json	dependencies.react-native-dialog="https://github.com/jitsi/react-native-dialog/releases/download/v9.2.2-jitsi.1/react-native-dialog-9.2.2.tgz"	12
high	Dependency Changed To Remote Vs Previous	package.json	dependencies.lib-jitsi-meet changed to remote spec in 12.1.0 vs 12.0.0: "https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz"	12
low	Install-time lifecycle script	package.json	postinstall="node sdk_instructions.js"	5

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.lib-jitsi-meet	https://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz	error	0	unexpected end of file
dependencies.react-native-dialog	https://github.com/jitsi/react-native-dialog/releases/download/v9.2.2-jitsi.1/react-native-dialog-9.2.2.tgz	error	0	unexpected end of file

Manifest

Package metadata

Scripts2

postinstallnode sdk_instructions.js
preparenode prepare_sdk.js

Dependencies42

@braintree/sanitize-url7.0.0
@jitsi/js-utils2.6.7
@jitsi/logger2.1.1
@react-navigation/bottom-tabs6.6.0
@react-navigation/elements1.3.30
@react-navigation/material-top-tabs6.6.13
@react-navigation/native6.1.17
@react-navigation/stack6.4.0
@stomp/stompjs7.0.0
@xmldom/xmldom0.8.7
abab2.0.6
base64-js1.5.1
dayjs1.11.13
grapheme-splitter1.0.4
i18n-iso-countries6.8.0
i18next17.0.6
i18next-http-backend2.2.1
js-md50.6.1
js-sha5120.8.0
jwt-decode2.2.0
lib-jitsi-meethttps://github.com/jitsi/lib-jitsi-meet/releases/download/v2144.0.0+94d0e53e/lib-jitsi-meet.tgz
lodash-es4.18.1
optional-require1.0.3
promise.withresolvers1.0.3
punycode2.3.0
react-emoji-render2.0.1
react-i18next10.11.4
react-linkify1.0.0-alpha
react-native-dialoghttps://github.com/jitsi/react-native-dialog/releases/download/v9.2.2-jitsi.1/react-native-dialog-9.2.2.tgz
react-native-paper5.10.3
…and 12 more.