PkgRadar

Package evidence

@nethesis/[email protected]

Remote Dependency Spec: dependencies.@nethesis/nethesis-solid-svg-icons="github:nethesis/Font-Awesome#ns-solid"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
317Mature · −50% score
First published
Nov 2022
Publisher
tommaso.ascani

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@nethesis/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@nethesis/[email protected]"],"fail_on":"review"}'
Publishertommaso.ascani
Artifact bytes2,421,034
Previous version1.0.9
Published2026-06-10T10:29:17.221Z
SHA-2564cfdbd92d3276688a84f3f4f954db2fda003a090ce7c577e9cac1094848c0823

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.@nethesis/nethesis-solid-svg-icons="github:nethesis/Font-Awesome#ns-solid"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
6Score
1.0.10Version
Status history (1 event)
  1. new → available · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondependencies.@nethesis/nethesis-solid-svg-icons="github:nethesis/Font-Awesome#ns-solid"12

Manifest

Package metadata

Scripts24
  • buildrm -rf ./dist && npm run build:css && rollup -c
  • build-packnpm run bump && npm run build && npm pack
  • build-pack:winnpm run bump && npm run build:win && npm pack
  • build:cssBROWSERSLIST_IGNORE_OLD_DATA=1 NODE_ENV=production npx tailwindcss -o ./dist/index.css --minify
  • build:widgetrm -rf ./dist-widget && parcel build ./src/index.widget.tsx --no-source-maps
  • build:windel /s /q dist && npm run build:wincss && rollup -c --configPlugin typescript
  • build:wincssset BROWSERSLIST_IGNORE_OLD_DATA=1 && set NODE_ENV=production && npx tailwindcss -o ./dist/index.css --minify
  • bumpnode bump-version.js
  • devnode scripts/generate-dev-host.js && parcel .dev/phone-island-dev.html --port 6006 --open
  • formatprettier --write './**/*.{js,jsx,ts,tsx,css,md,json}' --config ./.prettierrc
  • postversiongit push origin main --tags
  • preversionrm -rf dist-widget && npm run build:widget && git add dist-widget/index.widget.js dist-widget/index.widget.css && git commit -m 'chore(widget): release for jsDelivr'
  • publish:devnode publish-dev.js
  • publish:majornode check-publish.js major && npm version major --allow-same-version -m v%s --force
  • publish:minornode check-publish.js minor && npm version minor --allow-same-version -m v%s --force
  • publish:patchnode check-publish.js patch && npm version patch --allow-same-version -m v%s --force
  • releasenpm publish
  • release:widgetnode check-publish.js patch && npm version patch -m v%s
  • revert-bumpnode revert-bump.js
  • serve:widgetrm -rf ./widget-example/static/* && cp -rf ./dist-widget/* ./widget-example/static && npx http-server ./widget-example -o -c-1
  • startnpm run dev
  • testtsc --noEmit
  • watchrollup -w -c
  • watch:cssBROWSERSLIST_IGNORE_OLD_DATA=1 npx tailwindcss -o ./dist/index.css --watch
Dependencies25
  • @fortawesome/fontawesome-svg-core6.7.2
  • @fortawesome/free-solid-svg-icons6.7.2
  • @fortawesome/react-fontawesome0.2.6
  • @headlessui/react^2.2.8
  • @nethesis/nethesis-solid-svg-iconsgithub:nethesis/Font-Awesome#ns-solid
  • @rematch/core^2.2.0
  • @rematch/immer^2.1.3
  • @rematch/select^3.1.2
  • @testing-library/jest-dom^5.11.4
  • @testing-library/user-event^12.1.10
  • framer-motion^12.0.0
  • i18next^22.4.9
  • i18next-browser-languagedetector^7.0.1
  • js-base64^3.7.3
  • lodash^4.17.21
  • mic-check^1.1.0
  • react^18.2.0
  • react-dom^18.2.0
  • react-i18next^12.1.5
  • react-moment^1.1.2
  • react-redux^8.0.5
  • react-tooltip^5.28.0
  • socket.io-client^4.5.3
  • styled-components^5.3.6
  • webrtc-adapter^9.0.1