Package evidence
@mindvalley/[email protected]
Remote Dependency Spec: devDependencies.semantic-release-github-pullrequest="github:njausteve/semantic-release-github-pullrequest"
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@mindvalley/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@mindvalley/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Remote Dependency Spec: devDependencies.semantic-release-github-pullrequest="github:njausteve/semantic-release-github-pullrequest"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 15 · status changed
Evidence
Static findings
3 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Dependency Spec | package.json | devDependencies.semantic-release-github-pullrequest="github:njausteve/semantic-release-github-pullrequest" | 8 |
Show all 3 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Dependency Spec | package.json | devDependencies.semantic-release-github-pullrequest="github:njausteve/semantic-release-github-pullrequest" | 8 |
| low | Install-time lifecycle script | package.json | prepare="lefthook install --force" | 4 |
| low | Obfuscation | package/dist/helpers/regex.js | matched "\\xC0" | 3 |
Manifest
Package metadata
Scripts40
buildpnpm validate-tokens && npm-run-all -n build:styledictionary build:ts build:bundle && rimraf dist/buildbuild:bundlewebpack --mode productionbuild:figmanpm-run-all -n -p build:figma:icons build:figma:wordmarks -s clean:docs buildbuild:figma:iconspnpm --filter @mindvalley/icons run build:figma:iconsbuild:figma:wordmarkstsx ./node_modules/@figma-export/cli/bin/run use-config ./src/utilities/svg-import/.figma_wordmarks.tsbuild:styledictionaryts-node ./build.tsbuild:tstsc -p tsconfig.build.json && resolve-tspaths -p tsconfig.build.jsonbuild:typestsc --emitDeclarationOnly -p tsconfig.build.jsoncheckbiome check --write ./srccheck:changedbiome check --changedcheck:cibiome ci ./srccheck:stagedbiome check --stagedclean:docsrimraf 'src/assets/**/docs' --globcommitczgcommitlintcommitlint --editformatbiome format --write .format:checkbiome format .lintbiome lint ./srclint:fixbiome lint --write ./srclint:mdmarkdownlint-cli2 "**/*.md"lint:md:fixmarkdownlint-cli2 --fix "**/*.md"nxnxpreparelefthook install --forcereleasesemantic-release --debug --config release.config.jsrelease:packagesnx releaserelease:packages:drynx release --dry-runstorybookpnpm --dir apps/storybook run devstorybook:buildpnpm --dir apps/storybook run buildstorybook:reactpnpm --dir apps/storybook-react run devstorybook:react:buildpnpm --dir apps/storybook-react run build- …and 10 more.