PkgRadar

Package evidence

@nuskin/[email protected]

Large Javascript Payload: 4280817 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
757
Versions published
41
First published
Apr 2026
Publisher
nuskin-cws

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@nuskin/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@nuskin/[email protected]"],"fail_on":"review"}'
Publishernuskin-cws
Artifact bytes4,040,921
Previous version1.32.0
Published2026-05-22T14:35:27.017Z
SHA-2568c4fa97aabd08c17ba3f78926105b00bff27f2848be9b5d6e240460716e6b5f3

Why flagged

What the scanner saw

Large Javascript Payload: 4280817 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
20Score
1.33.0Version
Status history (1 event)
  1. new → available · risk review · score 20 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/package-dist/index.js4280817 bytes10
mediumLarge Javascript Payloadpackage/package-dist/index.mjs4261466 bytes10

Manifest

Package metadata

Scripts15
  • buildyarn build:local
  • build-devcross-env CMS_ENV=dev yarn build:server:dev && cross-env CMS_ENV=dev yarn build:client:dev && yarn build-storybook
  • build-prodcross-env CMS_ENV=prod NODE_ENV=production yarn build:server:prod && cross-env CMS_ENV=prod NODE_ENV=production yarn build:client:prod
  • build-storybookcross-env SB_DISABLE_TELEMETRY=1 CI=true storybook build -o dist/storybook
  • build-testcross-env CMS_ENV=test yarn build:server:dev && cross-env CMS_ENV=test yarn build:client:dev && yarn build-storybook
  • build:client:devrimraf --glob dist/*.js dist/*.js.map dist/loadable-stats.json dist/index.html && yarn webpack --mode development --progress --config config/webpack.client.js
  • build:client:prodrimraf --glob dist/*.js dist/*.js.map dist/loadable-stats.json dist/index.html && yarn webpack --mode production --progress --config config/webpack.client.js
  • build:localcross-env CMS_ENV=local yarn build:server:dev && cross-env CMS_ENV=local yarn build:client:dev && yarn build-storybook
  • build:packagerimraf package-dist && webpack --mode production --config config/webpack.library.js && shx cp src/library/index.d.ts package-dist/index.d.ts
  • build:server:devrimraf dist/server && yarn webpack --mode development --progress --config config/webpack.server.js
  • build:server:prodrimraf dist/server && yarn webpack --mode production --progress --config config/webpack.server.js
  • integration-testecho 'Integration test not yet implemented'
  • linteslint src/ --ext .js,.jsx
  • startnodemon --watch src --ext js,jsx,css --delay 2 --exec "yarn build:local && node server-launcher.js"
  • testjest
Dependencies30
  • @contentstack/delivery-sdk^4.10.3
  • @contentstack/live-preview-utils^4.1.2
  • @contentstack/utils1.7.0
  • @emotion/react^11.14.0
  • @emotion/styled^11.14.1
  • @mui/icons-material^5.15.0
  • @mui/material^5.15.0
  • @mui/system^5.15.0
  • @nuskin/configuration-sdk^3.0.2
  • @nuskin/foundation-theme1.8.0
  • @nuskin/foundation-ui-components^2.2.0
  • contentstack^3.26.2
  • core-js^3.39.0
  • cross-env7.0.3
  • dotenv^17.2.1
  • eslint^8
  • eslint-config-next14.0.4
  • eslint-plugin-prettier^5.2.4
  • eslint-plugin-spellcheck^0.0.20
  • eslint-plugin-unused-imports^3.1.0
  • express^4.21.2
  • jest29.7.0
  • jest-environment-jsdom29.7.0
  • prettier^3.5.3
  • prop-types^15.8.1
  • pubsub-js^1.9.5
  • react^18.2.0
  • react-dom^18.2.0
  • react-gtm-module^2.0.11
  • regenerator-runtime0.14.1