Package evidence

@neo4j-cypher/[email protected]

Large Javascript Payload: 18461676 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 459Mature · −50% score
First published: Oct 2023
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@neo4j-cypher/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@neo4j-cypher/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes10,548,345

Previous version0.0.0-canary-20260527115545

Published2026-05-28T09:58:06.372Z

SHA-256f1cf94a1c50a29f9dd4cd4a80297d8f953e459298e38d2f1fd90edc8b3007a89

Why flagged

What the scanner saw

Large Javascript Payload: 18461676 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

16d agoLast checked

reviewRisk

15Score

0.0.0-canary-20260528095551Version

Status history (1 event)

new → available16d ago · risk review · score 15 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/cjs/index.cjs	18461676 bytes	10
medium	Large Javascript Payload	package/dist/esm/project/language-support/src/syntaxValidation/semanticAnalysis.js	5097546 bytes	10
medium	Large Javascript Payload	package/src/syntaxValidation/semanticAnalysis.js	5097546 bytes	10
medium	Large Javascript Payload	package/dist/esm/project/language-support/src/tests/testData.js	5093704 bytes	10
medium	Large Javascript Payload	package/dist/esm/formatting/cli.mjs	2333992 bytes	10

Manifest

Package metadata

Scripts9

benchmarkesbuild ./src/tests/benchmarks/benchmark.ts --bundle --outfile=dist/benchmark/benchmark.js && BENCHMARKING=true node dist/benchmark/benchmark.js
buildcd ../../vendor/antlr4-c3/ && pnpm build && cd - && pnpm gen-parser && concurrently 'npm:build-esm-and-types' 'npm:build-commonjs' 'npm:build-cypherfmt-cli'
build-commonjsesbuild ./src/index.ts --bundle --format=cjs --sourcemap --outfile=dist/cjs/index.cjs
build-cypherfmt-cliesbuild ./src/formatting/cli.ts --bundle --format=esm --sourcemap --outfile=dist/esm/formatting/cli.mjs --external:fs --external:path
build-esm-and-typestsc --module esnext --outDir dist/esm/project/language-support && cp src/syntaxValidation/semanticAnalysis.js dist/esm/project/language-support/src/syntaxValidation/semanticAnalysis.js && mkdir -p dist/esm/vendor/antlr4-c3/dist/ && cp -r ../../vendor/antlr4-c3/dist/esm dist/esm/vendor/antlr4-c3/dist/
cleanrm -rf {dist,src/generated-parser}
devpnpm build && concurrently 'tsc --module esnext --outDir dist/esm/project/language-support --watch' 'npm:build-commonjs -- --watch'
gen-parsercross-env ANTLR4_TOOLS_ANTLR_VERSION=4.13.2 antlr4 -Dlanguage=TypeScript -visitor src/antlr-grammar/CypherCmdLexer.g4 src/antlr-grammar/CypherCmdParser.g4 -o src/generated-parser/ -Xexact-output-dir
testvitest run

Dependencies3

antlr44.13.2
fastest-levenshtein^1.0.16
vscode-languageserver-types^3.17.3