PkgRadar

Package evidence

@orangesk/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,469Niche · −30% score
Versions published
211Mature · −50% score
First published
Jan 2019
Publisher
benjamin.stary

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@orangesk/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@orangesk/[email protected]"],"fail_on":"review"}'
Publisherbenjamin.stary
Artifact bytes12,535,189
Previous version2.0.0-beta.48
Published2026-05-27T11:49:23.872Z
SHA-256c15d0b4e2fce7339980db9ba155b43126b0decc15ff9214a0048b6df0ffa322b

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
2.0.0-beta.49Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts26
  • buildnpm run build:scss-exports && npm run build:search-index && next build && npm run sprite
  • build:bundlenpm run build:scss-exports && pnpm exec rollup -c && npm run build:megamenu && npm run build:footer
  • build:footernpm run build:scss-exports && pnpm exec rollup -c rollup.footer.config.mjs
  • build:megamenunpm run build:scss-exports && pnpm exec rollup -c rollup.megamenu.config.mjs
  • build:scss-exportsnode scripts/build-scss-exports.js
  • build:search-indexnode scripts/mdx-search-index.js
  • checkbiome check .
  • check:fixbiome check --write .
  • coveragevitest run --coverage
  • devnpm run build:scss-exports && npm run build:search-index && next dev
  • dev:footernpm run build:scss-exports && pnpm exec rollup -c rollup.footer.config.mjs --watch
  • dev:megamenunpm run build:scss-exports && pnpm exec rollup -c rollup.megamenu.config.mjs --watch
  • formatbiome format --write . && prettier --write '**/*.{mdx,scss}'
  • format:biomebiome format --write .
  • format:prettierprettier --write '**/*.{mdx,scss}'
  • imports:fixbiome check --write --only=assist/source/organizeImports .
  • lintbiome lint .
  • lint:fixbiome lint --write .
  • lint:fix:unsafebiome lint --write --unsafe .
  • preparehusky
  • spritesvg-sprite --symbol --symbol-dest public --symbol-sprite sprite.svg src/assets/icons/*.svg
  • startnext start
  • testvitest
  • test:uivitest --ui
  • test:visual:dockerdocker run --rm --init --ipc=host -e CI=1 -v "$PWD":/work -w /work mcr.microsoft.com/playwright:v1.58.2-noble bash -lc "corepack enable && pnpm install --frozen-lockfile --ignore-scripts && pnpm run test:visual"
  • test:visual:docker:updatedocker run --rm --init --ipc=host -e CI=1 -v "$PWD":/work -w /work mcr.microsoft.com/playwright:v1.58.2-noble bash -lc "corepack enable && pnpm install --frozen-lockfile --ignore-scripts && pnpm run test:visual:update"
Dependencies32
  • @cloudfour/transition-hidden-element^2.0.2
  • @mdx-js/loader^3.1.1
  • @mdx-js/react^3.1.1
  • @next/mdx16.2.6
  • @orangesk/accessible-autocomplete3.2.2
  • @popperjs/core^2.11.8
  • @types/mdx^2.0.13
  • a11y-dialog^8.1.5
  • classnames^2.5.1
  • daypickr^0.3.4
  • diff2html^3.4.56
  • dompurify^3.4.6
  • html-react-parser6.1.2
  • lorem-ipsum3.0.0
  • minisearch7.2.0
  • next16.2.6
  • normalize.css^8.0.1
  • nouislider^15.8.1
  • prism-react-renderer^2.4.1
  • query-string^9.3.1
  • react^19.2.6
  • react-dom^19.2.6
  • react-element-to-jsx-string^17.0.1
  • react-is^19.2.6
  • rehype-autolink-headings^7.1.0
  • rehype-slug^6.0.0
  • remark-gemoji^8.0.0
  • remark-gfm^4.0.1
  • swiper12.1.4
  • tabbable^6.4.0
  • …and 2 more.