PkgRadar

Package evidence

@openfin/[email protected]

Large Javascript Payload: 2411882 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
735
Versions published
142Mature · −50% score
First published
Apr 2025
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@openfin/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@openfin/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes629,517
Previous version45.0.0-alpha-4675
Published2026-05-27T20:37:30.744Z
SHA-256b4eb0976973ce9e5b761b8e061249b7e3f0573823e6dbb49949a65f32a62f0b1

Why flagged

What the scanner saw

Large Javascript Payload: 2411882 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
45.0.0-alpha-4681Version
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/web/index.js2411882 bytes10

Manifest

Package metadata

Dependencies26
  • @openfin/predux1.0.0-alpha.1
  • @radix-ui/react-icons>=1.3.2 <2.0.0
  • date-fns>=4.1.0 <5.0.0
  • date-fns-tz>=3.2.0 <4.0.0
  • formik>=2.4.6 <3.0.0
  • framer-motion>=11.18.2 <12.0.0
  • fuse.js>=7.0.0 <8.0.0
  • history>=4.10.1 <5.0.0
  • inversify>=6.1.6 <7.0.0
  • lodash>=4.17.21 <5.0.0
  • lodash.clamp>=4.0.3 <5.0.0
  • lodash.noop>=3.0.1 <4.0.0
  • lodash.throttle>=4.1.1 <5.0.0
  • markdown-it>=14.1.0 <15.0.0
  • react>=18.3.1 <19.0.0
  • react-calendar>=5.1.0 <6.0.0
  • react-dom>=18.3.1 <19.0.0
  • react-redux>=7.0.2 <8.0.0
  • react-router>=5.3.4 <6.0.0
  • react-router-dom>=5.1.2 <6.0.0
  • react-transition-group>=4.4.5 <5.0.0
  • reflect-metadata>=0.2.2 <1.0.0
  • reselect>=5.1.1 <6.0.0
  • semver-compare>=1.0.0 <2.0.0
  • styled-components>=5.3.11 <6.0.0
  • yup>=0.32.9 <1.0.0