Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 108
- First published
- Apr 2026
- Publisher
- mwashburn160
Recommended action
Looks clean — keep monitoringNo high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@pipeline-builder/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@pipeline-builder/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
No high-signal static finding in the saved report.
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk low · score 0 · status changed
Evidence
Static findings
No findings stored for this release.
Manifest
Package metadata
Scripts11
buildpnpm dlx projen buildcompilepnpm dlx projen compiledefaultpnpm dlx projen defaulteslintpnpm dlx projen eslintpackagepnpm dlx projen packagepost-compilepnpm dlx projen post-compilepre-compilepnpm dlx projen pre-compileprojenpnpm dlx projentestpnpm dlx projen testtest:watchpnpm dlx projen test:watchwatchpnpm dlx projen watch
Dependencies3
@pipeline-builder/api-core3.4.70drizzle-orm0.45.2pg8.21.0