PkgRadar

Package evidence

@labelbox/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
4
First published
May 2023
Publisher
kharutyunyan

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@labelbox/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@labelbox/[email protected]"],"fail_on":"review"}'
Publisherkharutyunyan
Artifact bytes7,669,729
Previous version0.0.1
Published2023-05-09T00:33:03.365Z
SHA-2562e76f16f0edbc1790c6ade76b4070832412655a2cbd0c519314a7b7b07bbfaf5

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
24Score
0.0.2Version
Status history (1 event)
  1. new → available · risk review · score 24 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/umd/Sources/Common/System/MobileVR/fetchDatabase.shmatched "curl "12
mediumRemote Payloadpackage/Sources/Common/System/MobileVR/fetchDatabase.shmatched "curl "12
Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/umd/Sources/Common/System/MobileVR/fetchDatabase.shmatched "curl "12
mediumRemote Payloadpackage/Sources/Common/System/MobileVR/fetchDatabase.shmatched "curl "12
lowLarge Javascript Payloadpackage/dist/umd/vtk-lite.js2216138 bytes0
lowLarge Javascript Payloadpackage/dist/umd/vtk.js2436684 bytes0

Manifest

Package metadata

Scripts27
  • buildnpm run build:release
  • build:esmnpm run patch-build-deps && rollup -c rollup.config.js
  • build:releasenpm run lint && concurrently "cross-env NOLINT=1 npm run build:esm" "cross-env NOLINT=1 npm run build:umd"
  • build:umdwebpack --config webpack.prod.js --progress
  • commitgit cz
  • dev:esmnpm run build:esm -- -w
  • dev:umdwebpack --watch --config webpack.dev.js --progress
  • dockw-doc -c ./Documentation/config.js
  • doc:generate-apinode ./Documentation/generate-api-docs.js
  • doc:publishkw-doc -c ./Documentation/config.js -mp
  • doc:wwwnpm t -- --single-run && kw-doc -c ./Documentation/config.js -s
  • examplenode ./Utilities/ExampleRunner/example-runner-cli.js -c ./Documentation/config.js
  • linteslint Sources Examples
  • lint-fixeslint --fix Sources Examples
  • patch-build-depspatch-package --patch-dir ./Utilities/build/patches
  • preparenode ./Utilities/prepare.js
  • reformatprettier --config ./prettier.config.js --write "Sources/**/*.js" "Examples/**/*.js"
  • reformat-onlyprettier --single-quote --trailing-comma es5 --print-width 80 --arrow-parens always --write
  • release:create-packagesnode ./Utilities/ci/build-npm-package.js
  • semantic-releasesemantic-release
  • testkarma start ./karma.conf.js
  • test:debugkarma start ./karma.conf.js --no-single-run
  • test:firefoxkarma start ./karma.conf.js --browsers Firefox
  • test:firefox-debugkarma start ./karma.conf.js --browsers Firefox --no-single-run
  • test:headlesskarma start ./karma.conf.js --browsers ChromeHeadlessNoSandbox --single-run
  • test:webgpucross-env WEBGPU=1 NO_WEBGL=1 karma start ./karma.conf.js --browsers ChromeWebGPU --no-single-run
  • validateprettier --config ./prettier.config.js --list-different "Sources/**/*.js" "Examples/**/*.js"
Dependencies15
  • @babel/runtime7.16.7
  • blueimp-md52.19.0
  • commander8.3.0
  • d3-scale4.0.2
  • gl-matrix3.4.3
  • globalthis1.0.2
  • jszip3.7.1
  • pako2.0.4
  • seedrandom3.0.5
  • shader-loader1.3.1
  • shelljs0.8.5
  • stream-browserify3.0.0
  • webworker-promise0.4.4
  • worker-loader3.0.8
  • xmlbuilder23.0.2