PkgRadar

Package evidence

@lautec-gis/[email protected]

Large Javascript Payload: 19389139 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
4
First published
May 2026
Publisher
additherebel

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@lautec-gis/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@lautec-gis/[email protected]"],"fail_on":"review"}'
Publisheradditherebel
Artifact bytes13,612,556
Previous version3.24.1
Published2026-05-26T18:19:51.802Z
SHA-256ec1b27eada235a7a88a3dfb164004968bc3fc2bb3f97bda41a834acae423c888

Why flagged

What the scanner saw

Large Javascript Payload: 19389139 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
10Score
3.24.2Version
Status history (1 event)
  1. new → available · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/mapbox-gl-dev.js19389139 bytes10

Manifest

Package metadata

Scripts57
  • build-allrun-p build-umd build-esm-dev build-esm-prod build-csp
  • build-csprollup -c rollup.config.csp.ts
  • build-csspostcss -o dist/mapbox-gl.css src/css/mapbox-gl.css
  • build-devrollup -c --environment BUILD:dev
  • build-dtsdts-bundle-generator --no-banner --export-referenced-types=false --umd-module-name=mapboxgl --project ./tsconfig.browser.json -o ./dist/mapbox-gl.d.ts ./src/index.ts
  • build-dts-esmdts-bundle-generator --no-banner --export-referenced-types=false --project ./tsconfig.browser.json -o ./dist/esm/mapbox-gl.d.ts ./src/index.esm.ts
  • build-esm-devrollup -c rollup.config.esm.ts --environment BUILD:dev
  • build-esm-prodrollup -c rollup.config.esm.ts --environment BUILD:production,MINIFY:true
  • build-prodrollup -c --environment BUILD:production,MINIFY:true
  • build-style-specnpm run build --workspace src/style-spec && mkdir -p dist/style-spec && cp src/style-spec/dist/* dist/style-spec
  • build-tokennode build/generate-access-token-script.js
  • build-umdrun-s build-dev build-prod
  • bump-version./build/bump-version.ts
  • codegentsx ./build/generate-style-code.ts && tsx ./build/generate-struct-arrays.ts && tsx ./build/generate-typed-style-spec.ts
  • linteslint --cache .
  • lint-cssstylelint 'src/css/mapbox-gl.css'
  • preparenpm run build-prod && npm run build-css && npm run build-esm-prod
  • prepare-release-pagesln -sfn $PWD/dist test/release/dist && ln -sfn $PWD/debug test/release/debug && cp debug/access_token_generated.js test/release/
  • prepublishOnlyrun-s build-all build-css build-style-spec build-dts build-dts-esm
  • pretest-rendernpm run build-dev
  • pretest-render-cspnpm run build-csp
  • pretest-render-prodnpm run build-prod
  • print-release-urlnode build/print-release-url.js
  • publish-alpha./build/publish-alpha.ts
  • publish-cdn./build/publish-cdn.ts
  • publish-packagebash -c 'set -a && source .env && set +a && npm publish'
  • publish-release./build/publish.ts
  • sizesize-limit
  • startrun-p build-token watch-css watch-esm start-server
  • start-allrun-p build-token watch-css watch-dev watch-esm start-server
  • …and 27 more.
Dependencies22
  • @mapbox/mapbox-gl-supported^3.0.0
  • @mapbox/point-geometry^1.1.0
  • @mapbox/tiny-sdf^2.0.6
  • @mapbox/unitbezier^0.0.1
  • @mapbox/vector-tile^2.0.4
  • @types/geojson^7946.0.16
  • @types/geojson-vt^3.2.5
  • @types/pbf^3.0.5
  • @types/supercluster^7.1.3
  • cheap-ruler^4.0.0
  • csscolorparser~1.0.3
  • earcut^3.0.1
  • geojson-vt^4.0.2
  • gl-matrix^3.4.4
  • kdbush^4.0.2
  • martinez-polygon-clipping^0.8.1
  • murmurhash-js^1.0.0
  • pbf^4.0.1
  • potpack^2.0.0
  • quickselect^3.0.0
  • supercluster^8.0.1
  • tinyqueue^3.0.0