PkgRadar

Package evidence

@longzai-intelligence/[email protected]

Suspicious Publish Context: {"package_age_days":0,"publisher":"joydragon","burst_same_day":3,"burst_week":6,"lure":{"kind":"token_affix","target":"typeorm"},"version_anomaly":false,"new_account":false}

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1
First published
Jun 2026
Publisher
joydragon

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@longzai-intelligence/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@longzai-intelligence/[email protected]"],"fail_on":"review"}'
Publisherjoydragon
Artifact bytes11,076
Previous versionnone
Published2026-06-15T01:17:35.875Z
SHA-2565c57a2695a45fa62145f1f1ba8fd217fe56c1084e6edafbee1ce8ab2b16b1e0e

Why flagged

What the scanner saw

Suspicious Publish Context: {"package_age_days":0,"publisher":"joydragon","burst_same_day":3,"burst_week":6,"lure":{"kind":"token_affix","target":"typeorm"},"version_anomaly":false,"new_account":false}

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
10Score
0.1.1Version
Status history (1 event)
  1. new → available · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumSuspicious Publish Contextmanifest{"package_age_days":0,"publisher":"joydragon","burst_same_day":3,"burst_week":6,"lure":{"kind":"token_affix","target":"typeorm"},"version_anomaly":false,"new_account":false}10

Manifest

Package metadata

Scripts35
  • buildtsdown
  • build:prodNODE_ENV=production tsdown
  • cleanrimraf dist tsconfig/.cache
  • db:migrate:generatetypeorm migration:generate src/migrations -d typeorm.config.ts
  • db:resetbun run scripts/reset-database.ts && bun run db:migrate:generate
  • devtsdown --watch
  • fmtoxfmt
  • fmt:checkoxfmt --check
  • lintbun run lint:oxlint
  • lint:eslinteslint .
  • lint:filebun run lint:file:oxlint
  • lint:file:eslinteslint
  • lint:file:oxlintoxlint
  • lint:fixbun run oxc:fix
  • lint:fix:eslinteslint . --fix
  • lint:fix:oxlintoxlint --fix
  • lint:oxlintoxlint
  • oxcbun run lint:oxlint && bun run fmt:check
  • oxc:fixbun run lint:fix:oxlint && bun run fmt
  • prepublishOnlybun run build:prod
  • testvitest run
  • test:coveragevitest run --coverage
  • test:watchvitest
  • typecheckbun run typecheck:ts7
  • typecheck:apptsc --noEmit -p tsconfig/app.json
  • typecheck:nodetsc --noEmit -p tsconfig/node.json
  • typecheck:testtsc --noEmit -p tsconfig/test.json
  • typecheck:ts6bun run typecheck:ts6:app && bun run typecheck:ts6:node && bun run typecheck:ts6:test
  • typecheck:ts6:apptsc --noEmit -p tsconfig/app.json
  • typecheck:ts6:nodetsc --noEmit -p tsconfig/node.json
  • …and 5 more.
Dependencies25
  • @longzai-intelligence/agent-implementation0.4.0
  • @longzai-intelligence/chat-implementation0.4.0
  • @longzai-intelligence/codebase-implementation0.4.0
  • @longzai-intelligence/comment-implementation0.4.0
  • @longzai-intelligence/dataset-implementation0.4.0
  • @longzai-intelligence/identity-implementation0.4.0
  • @longzai-intelligence/marketplace-implementation0.4.0
  • @longzai-intelligence/membership-implementation0.4.0
  • @longzai-intelligence/notification-implementation0.4.0
  • @longzai-intelligence/opencode-implementation0.4.0
  • @longzai-intelligence/order-implementation0.4.0
  • @longzai-intelligence/page-implementation0.4.0
  • @longzai-intelligence/payment-implementation0.4.0
  • @longzai-intelligence/peer-implementation0.4.0
  • @longzai-intelligence/plugin-implementation0.4.0
  • @longzai-intelligence/publish-implementation0.1.0
  • @longzai-intelligence/setting-implementation0.1.0
  • @longzai-intelligence/task-implementation0.1.0
  • @longzai-intelligence/tenant-implementation0.1.0
  • @longzai-intelligence/ticket-implementation0.4.0
  • @longzai-intelligence/workflow-implementation0.1.0
  • @longzai-intelligence/workspace-implementation0.1.0
  • dayjs^1.11.20
  • reflect-metadata^0.2.2
  • typeorm^1.0.0