PkgRadar

Package evidence

@nathapp/[email protected]

Large Javascript Payload: 4376095 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,910Niche · −30% score
Versions published
211
First published
Mar 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@nathapp/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@nathapp/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes883,292
Previous version0.67.17
Published2026-05-28T05:25:28.805Z
SHA-256ac0ef2ceae766b166b915422ac07909564859953e746f988a4af4bad18145872

Why flagged

What the scanner saw

Large Javascript Payload: 4376095 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
0.67.18Version
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/nax.js4376095 bytes10

Manifest

Package metadata

Scripts34
  • buildbun build bin/nax.ts --outdir dist --target bun --define "GIT_COMMIT=\"$(git rev-parse --short HEAD)\""
  • check-dead-testsbun run scripts/check-dead-tests.ts
  • check-test-overlapbun run scripts/check-test-overlap.ts
  • check:alias-internalsbun run scripts/check-alias-internals.ts
  • check:deep-relativesbun run scripts/check-deep-relatives.ts
  • check:deep-relatives:updatebun run scripts/check-deep-relatives.ts --update-baseline
  • check:dispatch-contextbash scripts/check-dispatch-context.sh
  • check:logger-storyidbun run scripts/check-logger-storyid.ts
  • check:logger-storyid:updatebun run scripts/check-logger-storyid.ts --update-baseline
  • check:nax-errorbun run scripts/check-nax-error.ts
  • check:nax-error:updatebun run scripts/check-nax-error.ts --update-baseline
  • check:no-adapter-wrapbash scripts/check-no-adapter-wrap.sh
  • check:no-real-global-naxbun run scripts/check-no-real-global-nax.ts
  • check:process-cwdbash scripts/check-process-cwd.sh
  • check:test-mocksbun scripts/check-inline-test-mocks.ts --strict
  • check:test-sizesbun run scripts/check-test-sizes.ts
  • devbun run bin/nax.ts
  • lintbun x biome check src/ bin/ && bun run check:no-real-global-nax && bun run check:alias-internals && bun run check:deep-relatives && bun run check:nax-error && bun run check:logger-storyid
  • lint:fixbun x biome check --write src/ bin/
  • lint:jsonbun x biome check src/ bin/ --reporter json && bun run check:nax-error 1>&2 && bun run check:logger-storyid 1>&2
  • preparegit config core.hooksPath .githooks
  • prepublishOnlybun run build
  • releasebun scripts/release.ts
  • testAGENT=1 bun run scripts/run-tests.ts
  • test:bailAGENT=1 bun run scripts/run-tests.ts --bail
  • test:bail-verbosebun run scripts/run-tests.ts --bail
  • test:fullFULL=1 NAX_PRECHECK=1 bun test test/ --timeout=60000
  • test:integrationbun test ./test/integration/ --timeout=60000
  • test:no-wrapbun test test/unit/ --timeout=5000 && bun test test/integration/ --timeout=5000 && bun test test/ui/ --timeout=5000
  • test:uibun test ./test/ui/ --timeout=60000
  • …and 4 more.
Dependencies8
  • @types/react^19.2.14
  • chalk^5.6.2
  • commander^13.1.0
  • ink^6.7.0
  • ink-spinner^5.0.0
  • ink-testing-library^4.0.0
  • react^19.2.4
  • zod^4.3.6