Package evidence

@odoo/[email protected]

Large Javascript Payload: 2748557 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 835Mature · −50% score
First published: Nov 2022
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@odoo/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@odoo/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes2,230,739

Previous version19.0.35

Published2026-05-27T05:58:14.181Z

SHA-2562afa61315d58fff93fe3a3548a1ba218418e6db2eb3e296bbf7c5257e88fd444

Why flagged

What the scanner saw

Large Javascript Payload: 2748557 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17d agoLast checked

reviewRisk

9Score

19.0.36Version

Status history (1 event)

new → available17d ago · risk review · score 9 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/o_spreadsheet.cjs.js	2748557 bytes	10
medium	Large Javascript Payload	package/dist/o_spreadsheet.esm.js	2737354 bytes	10
medium	Large Javascript Payload	package/dist/o_spreadsheet.iife.js	2818413 bytes	10

Manifest

Package metadata

Scripts24

buildnpm-run-all build:js bundle:esm "bundle:xml -- --outDir build" && node tools/bundle_scss/main.cjs --out build
build:jstsc --module es6 --incremental
bundle:devnpm-run-all build:js bundle:iife "bundle:xml -- --outDir build" && node tools/bundle_scss/main.cjs --out build
bundle:esmrolldown -c --format esm
bundle:iiferolldown -c --format iife
bundle:xmlnode tools/bundle_xml/main.cjs
check-formattingprettier . --check && eslint
devnpm-run-all --print-label bundle:dev --parallel server serve-static watch
disttsc --module es6 --declaration --declarationDir dist/types && rolldown -c && npm run bundle:xml -- --outDir dist && node tools/bundle_scss/main.cjs --out dist
linteslint --fix
monkeySPREADSHEET_MONKEY_COUNT=$npm_config_monkey_count jest 'tests/collaborative/collaborative_monkey_party.test.ts'
preparehusky install
prettierprettier . --write
serve-staticlive-server --host=127.0.0.1 --open=demo --watch=build/o_spreadsheet.iife.js,build/o_spreadsheet.xml,build/o_spreadsheet.css,main.css,demo
servernode tools/server/main.cjs
testtsc --noEmit --project tests/tsconfig.json && jest
test:watchjest --watch
unzipXlsxnode tools/bundle_xlsx/unzip_xlsx_demo.cjs
watchnpm-run-all -p watch:*
watch:bundlenpm run bundle:iife -- --watch
watch:scssnode tools/bundle_scss/watch_scss_files.cjs
watch:tsnpm run build:js -- --watch
watch:xmlnode tools/bundle_xml/watch_xml_templates.cjs
zipXlsxnode tools/bundle_xlsx/zip_xlsx_demo.cjs

Dependencies4

@odoo/owl2.8.2
bootstrap5.3.3
font-awesome^4.7.0
rbush^3.0.1

Optional dependencies25

@rolldown/binding-android-arm641.0.0
@rolldown/binding-darwin-arm641.0.0
@rolldown/binding-darwin-x641.0.0
@rolldown/binding-freebsd-x641.0.0
@rolldown/binding-linux-arm-gnueabihf1.0.0
@rolldown/binding-linux-arm64-gnu1.0.0
@rolldown/binding-linux-arm64-musl1.0.0
@rolldown/binding-linux-ppc64-gnu1.0.0
@rolldown/binding-linux-s390x-gnu1.0.0
@rolldown/binding-linux-x64-gnu1.0.0
@rolldown/binding-linux-x64-musl1.0.0
@rolldown/binding-openharmony-arm641.0.0
@rolldown/binding-wasm32-wasi1.0.0
@rolldown/binding-win32-arm64-msvc1.0.0
@rolldown/binding-win32-x64-msvc1.0.0
@swc/core-darwin-arm641.6.7
@swc/core-darwin-x641.6.7
@swc/core-linux-arm-gnueabihf1.6.7
@swc/core-linux-arm64-gnu1.6.7
@swc/core-linux-arm64-musl1.6.7
@swc/core-linux-x64-gnu1.6.7
@swc/core-linux-x64-musl1.6.7
@swc/core-win32-arm64-msvc1.6.7
@swc/core-win32-ia32-msvc1.6.7
@swc/core-win32-x64-msvc1.6.7