PkgRadar

Package evidence

@luomus/[email protected]

Large Javascript Payload: 2458239 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
561
Versions published
123Mature · −50% score
First published
Nov 2023
Publisher
rpulkka

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@luomus/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@luomus/[email protected]"],"fail_on":"review"}'
Publisherrpulkka
Artifact bytes1,218,370
Previous version15.1.119
Published2026-06-09T13:18:24.986Z
SHA-2566d109495b574a29dc4d968d0893c6937dabf569e97d5f650914ed814586a7647

Why flagged

What the scanner saw

Large Javascript Payload: 2458239 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
15.1.120Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowLarge Javascript Payloadpackage/dist/laji-form.js2458239 bytes0

Manifest

Package metadata

Scripts18
  • buildnpm run build:lib && npm run build:dist && npm run build:tests
  • build:distrimraf dist && NODE_ENV=production webpack --config webpack.config.dist.js && rimraf dist/styles.js
  • build:librimraf lib && NODE_ENV=production tsc -p tsconfig.lib.json && cpx src/generated/* lib/generated
  • build:testsrimraf test-export && NODE_ENV=production tsc -p tsconfig.test.json
  • generate:api-clientopenapi-typescript http://apitest.laji.fi/openapi-json -o ./src/generated/api.d.ts --properties-required-by-default
  • linteslint src playground
  • postversionnpm publish
  • prepublishOnlynpm run build && git push && git push --tags
  • preversionnpm run lint && npm run test:lightweight
  • stagingwebpack-dev-server --content-base playground playground/app.js --host 0.0.0.0 --port 4010
  • startnpx webpack serve
  • testnpx playwright test
  • test:dockernpm run test:docker:build && npm run test:docker:run --
  • test:docker:builddocker build -t laji-form-test -f test.Dockerfile .
  • test:docker:rundocker run laji-form-test
  • test:lightweightnpx playwright test --project chromium
  • test:uinpx playwright test --ui
  • versionbin/update-changelog.sh
Dependencies26
  • @luomus/laji-map^5.1.19
  • @luomus/laji-validate^0.0.132
  • @rjsf/core~5.1.0
  • @rjsf/utils~5.1.0
  • @rjsf/validator-ajv6~5.1.0
  • @types/deep-equal^1.0.1
  • @types/memoizee^0.4.8
  • @types/react^16.14.10
  • @types/react-dom^16.9.13
  • @types/react-spinner^0.2.0
  • deep-equal^2.0.5
  • deepmerge^4.2.2
  • exifreader^4.32.0
  • immutability-helper^3.1.1
  • isomorphic-fetch^3.0.0
  • memoizee^0.4.15
  • moment^2.29.1
  • prop-types^15.5.8
  • react^17.0.2
  • react-dom^17.0.2
  • react-dropzone^11.3.4
  • react-inlinesvg^2.3.0
  • react-sortable-hoc^2.0.0
  • react-spinner^0.2.7
  • react-widgets^4.6.1
  • react-widgets-moment^4.0.30
Optional dependencies6
  • @fortawesome/fontawesome-svg-core^6.2.0
  • @fortawesome/free-solid-svg-icons^6.2.0
  • @fortawesome/react-fontawesome^0.2.0
  • @types/react-bootstrap^0.32.22
  • react-bootstrap^0.33.1
  • react-bootstrap-5npm:react-bootstrap@^2.5.0