Package evidence

@lblod/[email protected]

Remote Dependency Spec: dependencies.@appuniversum/ember-appuniversum="https://github.com/abeforgit/ember-appuniversum/raw/refs/heads/fix/local-scoped-queryselect/appuniversum-ember-appuniversum-3.17.0.tgz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 258
Versions published: 35Mature · −50% score
First published: Oct 2023
Publisher: madnificent

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@lblod/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@lblod/[email protected]"],"fail_on":"high"}'

Publishermadnificent

Artifact bytes3,882,577

Previous version6.4.0

Published2026-06-19T14:37:45.964Z

SHA-256a318b7f775dff3fa7b824c7f67cc982d7ca7cbeae0921a06f60034ef028fa7e4

Why flagged

What the scanner saw

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

5h agoLast checked

highRisk

6Score

6.4.1Version

Status history (1 event)

new → available24h ago · risk high · score 6 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.@appuniversum/ember-appuniversum="https://github.com/abeforgit/ember-appuniversum/raw/refs/heads/fix/local-scoped-queryselect/appuniversum-ember-appuniversum-3.17.0.tgz"	12

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.@appuniversum/ember-appuniversum="https://github.com/abeforgit/ember-appuniversum/raw/refs/heads/fix/local-scoped-queryselect/appuniversum-ember-appuniversum-3.17.0.tgz"	12
low	Large Javascript Payload	package/dist/embeddable-say-editor.umd.js	3849904 bytes	0
low	Large Javascript Payload	package/dist/embeddable-say-editor.mjs	8529002 bytes	0

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.@appuniversum/ember-appuniversum	https://github.com/abeforgit/ember-appuniversum/raw/refs/heads/fix/local-scoped-queryselect/appuniversum-ember-appuniversum-3.17.0.tgz	error	0	unexpected end of file

Manifest

Package metadata

Scripts18

buildconcurrently "pnpm:build:types" "pnpm:build:package" --names "types,build"
build:packagevite build --config vite.config.mjs
build:test-appvite build --config vite.config.test-app.mts
build:typesember-tsc --build --declaration --emitDeclarationOnly
formatprettier . --cache --write
lintconcurrently "pnpm:lint:*(!fix)" --names "lint:" --prefixColors auto
lint:cssstylelint "**/*.css"
lint:css:fixconcurrently "pnpm:lint:css -- --fix"
lint:fixconcurrently "pnpm:lint:*:fix" --names "fix:" --prefixColors auto && pnpm format
lint:formatprettier . --cache --check
lint:hbsember-template-lint .
lint:hbs:fixember-template-lint . --fix
lint:jseslint . --cache
lint:js:fixeslint . --fix
lint:typesember-tsc --noEmit
startvite --config vite.config.test-app.mjs
testconcurrently "pnpm:lint" "pnpm:test:*" --names "lint,test:" --prefixColors auto
test:embervite build --mode test && ember test --path dist

Dependencies26

@appuniversum/ember-appuniversumhttps://github.com/abeforgit/ember-appuniversum/raw/refs/heads/fix/local-scoped-queryselect/appuniversum-ember-appuniversum-3.17.0.tgz
@ember/string4.0.1
@glimmer/component^2.0.0
@glimmer/tracking^1.1.2
@glint/ember-tsc^1.8.1
@lblod/ember-environment-banner^0.6.0
@lblod/ember-rdfa-editor13.9.1
@lblod/ember-rdfa-editor-lblod-plugins37.2.1
@types/leaflet^1.9.17
@types/lodash.mergewith^4.6.9
@types/rsvp^4.0.9
@types/uuid^10.0.0
ember-basic-dropdown^8.6.0
ember-concurrency^4.0.3
ember-intl^7.1.6
ember-leaflet^5.1.3
ember-modifier^4.2.0
ember-page-title^9.0.1
ember-power-select^8.7.0
ember-route-template^1.0.3
ember-source~6.3.0
ember-template-imports^4.3.0
leaflet^1.9.4
lodash.mergewith^4.6.2
tracked-built-ins^3.4.0
uuid^11.1.0