PkgRadar

Package evidence

@kezaa/[email protected]

Remote Dependency Spec: devDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
15
Versions published
4
First published
May 2026
Publisher
kezaa

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kezaa/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kezaa/[email protected]"],"fail_on":"review"}'
Publisherkezaa
Artifact bytes1,787,686
Previous version0.6.0-alpha.30
Published2026-05-20T14:11:23.957Z
SHA-25642a41998b3487e843da93ce1ee12f3920cc1e6530c191162530b968c18f1b127

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
16Score
0.6.0-alpha.31Version
Status history (1 event)
  1. new → available · risk review · score 16 · status changed

Evidence

Static findings

1 static · 1 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondevDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"8
mediumDependency Changed To Remote Vs Previouspackage.jsondevDependencies.@whiskeysockets/libsignal-node changed to remote spec in 0.6.0-alpha.31 vs 0.6.0-alpha.30: "git+https://github.com/whiskeysockets/libsignal-node"8

Manifest

Package metadata

Scripts15
  • benchbun run build && bun run benches/binary.ts && bun run benches/signal.ts && bun run benches/curve.ts && bun run benches/crypto.ts
  • bench:nodebun run build && node --expose-gc benches/binary.ts && node --expose-gc benches/signal.ts && node --expose-gc benches/curve.ts && node --expose-gc benches/crypto.ts
  • buildbun run gen && bun run build:wasm && bun run build:ts && bun run postbuild
  • build:devbun run gen && bun run build:wasm:dev && bun run build:ts && bun run postbuild
  • build:profilecargo build --profile profiling --target wasm32-unknown-unknown && wasm-bindgen --target web --out-dir pkg --keep-debug target/wasm32-unknown-unknown/profiling/whatsapp_rust_bridge.wasm && wasm-tools strip pkg/whatsapp_rust_bridge_bg.wasm -o pkg/whatsapp_rust_bridge_bg.wasm && bun run build:ts && bun run postbuild
  • build:tsbun build ts/index.ts --minify --outfile dist/index.js --target node && cp pkg/whatsapp_rust_bridge_bg.wasm dist/ && cp ts/proto-types.d.ts dist/proto-types.d.ts && cp ts/proto-types.d.ts pkg/proto-types.d.ts && printf 'export { proto } from "./index.js";\n' > dist/proto-types.js
  • build:wasmwasm-pack build --target web --out-dir pkg --no-pack
  • build:wasm:devwasm-pack build --target web --out-dir pkg --no-pack --dev
  • bump:wacorecargo update -p whatsapp-rust && bun run build
  • exampleNODE_TLS_REJECT_UNAUTHORIZED=0 bun run examples/connect.ts
  • genbun run gen:bridge-types && bun run gen:proto-types
  • gen:bridge-typescd codegen && cargo run -q --bin gen-types --target $(rustc -vV | grep host | cut -d' ' -f2) > ../src/generated_types.rs.tmp && mv ../src/generated_types.rs.tmp ../src/generated_types.rs
  • gen:proto-typesbun run scripts/gen-protobufjs-dts.ts
  • postbuildtsc -p tsconfig.json --outDir dist && rm -f dist/macro.d.ts && rm -rf dist/generated
  • prepublishOnlybun run build