Package evidence

@nysds/[email protected]

Remote Dependency Spec: devDependencies.cem-plugin-examples="github:its-hcd/cem-plugin-examples"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 55Mature · −50% score
First published: Feb 2025
Publisher: esteinborn

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@nysds/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@nysds/[email protected]"],"fail_on":"review"}'

Publisheresteinborn

Artifact bytes1,046,190

Previous version1.18.3

Published2026-06-09T20:14:56.411Z

SHA-25655999e81325621fb22b1c4ba97404138d48ba593b26116578c7a1a1e5083e06d

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.cem-plugin-examples="github:its-hcd/cem-plugin-examples"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

2d agoLast checked

reviewRisk

4Score

1.19.0Version

Status history (1 event)

new → available2d ago · risk review · score 4 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.cem-plugin-examples="github:its-hcd/cem-plugin-examples"	8

Manifest

Package metadata

Scripts34

buildtsc --emitDeclarationOnly && vite build
build-storybooknpm run build:packages && storybook build
build:allnpm run clean:dist && npm run lint && npm run lit-analyze || true && cross-env NODE_ENV=production npm run build:packages && npm run build:root && npm run cem && npm run build:mcp
build:linknpm run build:all && npm link && cd packages/styles && npm link
build:mcpnpm run build -w @nysds/mcp-server
build:packagesnpm run tsc:packages && turbo run build --filter='./packages/*' --log-order=grouped
build:rootcross-env NODE_ENV=production npm run build && cross-env NODE_ENV=production npm run build:umd
build:umdcross-env BUILD_FORMAT=umd vite build
cemnpx cem analyze --config ./custom-elements-manifest.config.mjs && cp ./custom-elements.json dist/ && node src/scripts/patch-react-utils.js
clean:allnpm run clean:dist && npm run clean:node && npm run clean:cache && find packages -name '*.tsbuildinfo' -delete 2>/dev/null || true && npm run clean:turbo
clean:cacherm -rf node_modules/.cache
clean:distrm -rf storybook-static && rm -rf coverage && rm -rf packages/*/coverage && rm -rf dist && find packages -type d -name dist ! -path '*/mcp-server/dist' -exec rm -rf {} + 2>/dev/null || true
clean:noderm -rf node_modules && rm -rf packages/*/node_modules && rm -rf packages/**/*/node_modules
clean:turbofind packages -type d -name '.turbo' -exec rm -rf {} + && rm -rf .turbo
code-connectdotenv -- npx figma connect publish
devvite
genplop
linteslint --cache --cache-strategy=content --cache-location node_modules/.cache/eslint && (stylelint "**/*.scss" || true)
lint:fixbash src/scripts/lint-fix.sh
lit-analyzefind ./packages/nys-*/ -name '*.ts' ! -name '*.figma.*' | xargs lit-analyzer {}
mcp-server:buildturbo run build --filter=@nysds/mcp-server
playwright:installnpx playwright install --with-deps
releasecross-env NODE_ENV=production npm run build:all && cross-env NODE_ENV=production npm run test && npm run cem && cross-env NODE_ENV=production npm publish --workspaces --access public && cross-env NODE_ENV=production npm publish --access public
release:alphanpm run build && npm run build:umd && npm publish --tag next
release:dry-runcross-env NODE_ENV=production npm run build:all && cross-env NODE_ENV=production npm run test && npm run cem && node src/scripts/publish-dry-run.js
release:zipnpm run build:all && node src/scripts/create-release-zip.js
storybookcross-env NODE_ENV=production storybook dev -p 6006
storybook:build:allcross-env NODE_ENV=production npm run build:all && npm run storybook
storybook:cibuildstorybook build
testnpm run playwright:install && wtr --node-resolve
…and 4 more.

Dependencies2

dompurify^3.4.7
wc-datepicker^0.10.0