Package evidence

@mapvx/[email protected]

Large Javascript Payload: 2860694 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 55
Versions published: 52Mature · −50% score
First published: Jun 2025
Publisher: lzdevelopers

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@mapvx/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@mapvx/[email protected]"],"fail_on":"review"}'

Publisherlzdevelopers

Artifact bytes16,669,907

Previous version0.1.1-beta.2

Published2026-05-06T19:40:55.953Z

SHA-2565b5a2e4254a151ddcc3ac0171a13a1dcfb09972f40cb77b9618ca32abaa2af1a

Why flagged

What the scanner saw

Large Javascript Payload: 2860694 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

22d agoLast checked

reviewRisk

28Score

0.1.1-beta.3Version

Status history (1 event)

new → available22d ago · risk review · score 28 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/cjs/sdk-controller-Ca4Ic2RN.cjs	2860694 bytes	10
medium	Large Javascript Payload	package/dist/iife/map-view-with-modal.js	3533357 bytes	10
medium	Large Javascript Payload	package/dist/iife/route-view-totems.js	3580993 bytes	10
medium	Large Javascript Payload	package/dist/es/assets/utils-gXN6se04.js	3322231 bytes	10

Manifest

Package metadata

Scripts29

analyzelit-analyzer
buildpnpm run build:es && pnpm run build:cjs && pnpm run build:iife && pnpm run build:copy-sw
build-with-sourcemaps./scripts/build-and-upload-sourcemaps.sh
build:cjsBUILD_FORMAT=cjs vite build
build:copy-swmkdir -p dist/sw && cp src/sw/mvx-tiles-sw.js dist/sw/mvx-tiles-sw.js
build:esBUILD_FORMAT=es vite build
build:iifeBUILD_FORMAT=iife-route-view-totems vite build && BUILD_FORMAT=iife-map-view-with-modal vite build
devvite --force
docs:buildNEXT_EXPORT=true cd docs && next build && cp ../src/docs-base-redirect.html ../docs-build/index.html
docs:devcd docs && next dev
docs:startcd docs && next start
formatprettier --write "**/*.{ts,js,json,html}"
linteslint . --ext .ts
lint:fixeslint . --ext .ts --fix
previewvite preview
sonarsonar-scanner
testvitest run
test:coveragevitest run --coverage
test:integrationstart-server-and-test dev http://localhost:3000 test:integration:run
test:integration:runvitest run --config vitest.integration.config.ts
test:playwrightplaywright test
test:playwright:debugplaywright test --debug
test:playwright:headedplaywright test --headed
test:playwright:installplaywright install --with-deps
test:playwright:mcpplaywright test src/tests/playwright/mcp/
test:playwright:reportplaywright show-report
test:playwright:uiplaywright test --ui
test:watchvitest
upload-sourcemaps./scripts/upload-sourcemaps-to-rollbar.sh

Dependencies4

@lzdevelopers/my-maps-js3.1.0-dev.1
lit^3.3.2
qrcode^1.5.4
rollbar^2.26.5