Package evidence

@labelbox/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 4
First published: May 2023
Publisher: kharutyunyan

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@labelbox/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@labelbox/[email protected]"],"fail_on":"review"}'

Publisherkharutyunyan

Artifact bytes1,425,710

Previous versionnone

Published2023-05-08T23:48:18.711Z

SHA-256d1fc37924b92039455c2f8b3c1ed1d0231f60af17688d256fe5033f3f0577d5a

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

9h agoLast checked

reviewRisk

12Score

0.0.1Version

Status history (1 event)

new → available9h ago · risk review · score 12 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/Sources/Common/System/MobileVR/fetchDatabase.sh	matched "curl "	12

Manifest

Package metadata

Scripts27

buildnpm run build:release
build:esmnpm run patch-build-deps && rollup -c rollup.config.js
build:releasenpm run lint && concurrently "cross-env NOLINT=1 npm run build:esm" "cross-env NOLINT=1 npm run build:umd"
build:umdwebpack --config webpack.prod.js --progress
commitgit cz
dev:esmnpm run build:esm -- -w
dev:umdwebpack --watch --config webpack.dev.js --progress
dockw-doc -c ./Documentation/config.js
doc:generate-apinode ./Documentation/generate-api-docs.js
doc:publishkw-doc -c ./Documentation/config.js -mp
doc:wwwnpm t -- --single-run && kw-doc -c ./Documentation/config.js -s
examplenode ./Utilities/ExampleRunner/example-runner-cli.js -c ./Documentation/config.js
linteslint Sources Examples
lint-fixeslint --fix Sources Examples
patch-build-depspatch-package --patch-dir ./Utilities/build/patches
preparenode ./Utilities/prepare.js
reformatprettier --config ./prettier.config.js --write "Sources/**/*.js" "Examples/**/*.js"
reformat-onlyprettier --single-quote --trailing-comma es5 --print-width 80 --arrow-parens always --write
release:create-packagesnode ./Utilities/ci/build-npm-package.js
semantic-releasesemantic-release
testkarma start ./karma.conf.js
test:debugkarma start ./karma.conf.js --no-single-run
test:firefoxkarma start ./karma.conf.js --browsers Firefox
test:firefox-debugkarma start ./karma.conf.js --browsers Firefox --no-single-run
test:headlesskarma start ./karma.conf.js --browsers ChromeHeadlessNoSandbox --single-run
test:webgpucross-env WEBGPU=1 NO_WEBGL=1 karma start ./karma.conf.js --browsers ChromeWebGPU --no-single-run
validateprettier --config ./prettier.config.js --list-different "Sources/**/*.js" "Examples/**/*.js"

Dependencies15

@babel/runtime7.16.7
blueimp-md52.19.0
commander8.3.0
d3-scale4.0.2
gl-matrix3.4.3
globalthis1.0.2
jszip3.7.1
pako2.0.4
seedrandom3.0.5
shader-loader1.3.1
shelljs0.8.5
stream-browserify3.0.0
webworker-promise0.4.4
worker-loader3.0.8
xmlbuilder23.0.2