PkgRadar

Package evidence

@kezaa/[email protected]

Remote Dependency Spec: devDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
6
First published
May 2026
Publisher
kezaa

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kezaa/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kezaa/[email protected]"],"fail_on":"review"}'
Publisherkezaa
Artifact bytes1,864,517
Previous version0.8.0
Published2026-06-04T20:55:31.012Z
SHA-256aa39ea5a9179ba662dc2e316cccf942d78e16c67b3064bb25c9fed2741802fdc

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
8Score
0.9.0Version
Status history (1 event)
  1. new → available · risk review · score 8 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondevDependencies.@whiskeysockets/libsignal-node="git+https://github.com/whiskeysockets/libsignal-node"8

Manifest

Package metadata

Scripts16
  • benchbun run build && bun run benches/binary.ts && bun run benches/signal.ts && bun run benches/curve.ts && bun run benches/crypto.ts
  • bench:nodebun run build && node --expose-gc benches/binary.ts && node --expose-gc benches/signal.ts && node --expose-gc benches/curve.ts && node --expose-gc benches/crypto.ts
  • buildbun run gen && bun run build:wasm && bun run build:ts && bun run postbuild
  • build:devbun run gen && bun run build:wasm:dev && bun run build:ts && bun run postbuild
  • build:profilecargo build --profile profiling --target wasm32-unknown-unknown && wasm-bindgen --target web --out-dir pkg --keep-debug target/wasm32-unknown-unknown/profiling/whatsapp_rust_bridge.wasm && wasm-tools strip pkg/whatsapp_rust_bridge_bg.wasm -o pkg/whatsapp_rust_bridge_bg.wasm && bun run build:ts && bun run postbuild
  • build:tsbun build ts/index.ts --minify --outfile dist/index.js --target node && cp pkg/whatsapp_rust_bridge_bg.wasm dist/ && cp ts/proto-types.d.ts dist/proto-types.d.ts && cp ts/proto-types.d.ts pkg/proto-types.d.ts && printf 'export { proto } from "./index.js";\n' > dist/proto-types.js
  • build:wasmwasm-pack build --target web --out-dir pkg --no-pack
  • build:wasm:devwasm-pack build --target web --out-dir pkg --no-pack --dev
  • bump:wacorecargo update -p whatsapp-rust && bun run build
  • exampleNODE_TLS_REJECT_UNAUTHORIZED=0 bun run examples/connect.ts
  • genbun run gen:bridge-types && bun run gen:proto-types
  • gen:bridge-typescd codegen && cargo run -q --bin gen-types --target $(rustc -vV | grep host | cut -d' ' -f2) > ../src/generated_types.rs.tmp && mv ../src/generated_types.rs.tmp ../src/generated_types.rs
  • gen:proto-typesbun run scripts/gen-protobufjs-dts.ts
  • postbuildtsc -p tsconfig.json --outDir dist && rm -f dist/macro.d.ts && rm -rf dist/generated
  • prepublishOnlybun run build
  • test:rustwasm-pack test --node