Package evidence

@pareto-engineering/[email protected]

Remote Dependency Spec: devDependencies.@heartexlabs/eslint-plugin-frontend="https://github.com/heartexlabs/eslint-plugin-frontend.git"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 14Established · −30% score
First published: Oct 2023
Publisher: pamespareto

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pareto-engineering/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pareto-engineering/[email protected]"],"fail_on":"review"}'

Publisherpamespareto

Artifact bytes13,649,783

Previous version1.5.3

Published2024-02-29T19:43:20.975Z

SHA-2560978c81cc4b380fc960c20af9c1ded35413aefa108e28c5055ec0cf9c2ab66ec

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.@heartexlabs/eslint-plugin-frontend="https://github.com/heartexlabs/eslint-plugin-frontend.git"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17h agoLast checked

reviewRisk

5Score

1.5.4Version

Status history (1 event)

new → available17h ago · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.@heartexlabs/eslint-plugin-frontend="https://github.com/heartexlabs/eslint-plugin-frontend.git"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.@heartexlabs/eslint-plugin-frontend	https://github.com/heartexlabs/eslint-plugin-frontend.git	error	0	invalid gzip header

Manifest

Package metadata

Scripts20

buildwebpack
build-bundleyarn run build:final
build-notsourcemapGENERATE_SOURCEMAP=false yarn run build
build:finalBUILD_NO_CHUNKS=true yarn run build
build:moduleBUILD_MODULE=true yarn run build:no-hash
build:no-hashBUILD_NO_HASH=true BUILD_NO_CHUNKS=true yarn run build
copy-examplesbash scripts/copy.sh
coverage:mergenpx nyc merge coverage/ coverage/coverage.json && rm -f coverage/*.coverage.json
docs:generatenode scripts/create-docs.js
linteslint src/
lint:writeeslint --debug src/ --fix
prettierprettier --write src/**/*.js
prettier-stylesprettier --write src/**/*.{css,scss}
publishsh scripts/publish.sh $(grep TOKEN .env | cut -d '=' -f 2)
sizeyarn run build && size-limit
startyarn run copy-examples && node dev-server.js
testyarn jest src
test:coverageyarn test -- --coverage
test:watchreact-scripts test
watchwebpack --watch

Dependencies18

@babel/plugin-proposal-private-methods^7.18.6
@martel/audio-file-decoder2.3.15
@thi.ng/rle-pack^2.1.6
@types/react-beautiful-dnd^13.1.3
@types/sanitize-html^2.9.5
babel-plugin-istanbul^6.1.1
babel-preset-react-app^9.1.1
d3^5.16.0
d3-color3.1.0
loader-utils2.0.4
magic-wand-js^1.0.0
papaparse^5.3.1
rc-tree^5.3.0
react-beautiful-dnd^13.1.1
react-konva-utils^0.2.0
react-virtualized-auto-sizer^1.0.6
react-window^1.8.6
sanitize-html^2.11.0