Package evidence

@roomstay/[email protected]

Large Javascript Payload: 3072927 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,018Niche · −30% score
Versions published: 327Mature · −50% score
First published: Sep 2022
Publisher: rob.ellis

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@roomstay/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@roomstay/[email protected]"],"fail_on":"review"}'

Publisherrob.ellis

Artifact bytes3,376,833

Previous version2.9.1-2

Published2026-05-24T23:46:40.125Z

SHA-256243cf0a8d5c8814ee91cb4bc823cfce03e441cd45ecc86b722535dc8247c215e

Why flagged

What the scanner saw

Large Javascript Payload: 3072927 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

40Score

2.9.1Version

Status history (2 events)

available → available19d ago · risk review · score 40 · status available -> available, risk high -> review, score 142 -> 40
new → available19d ago · risk high · score 142 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Install Lifecycle Suppresses Failure — prepare="husky install > /dev/null"

2 members · evidence strength 70

Evidence

Static findings

24 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/vendors.bundle.js	3072927 bytes	10

Show all 24 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/vendors.bundle.js	3072927 bytes	10
low	Credential file access	package/dist/535.bundle.js	matched ".AWS"	5
low	Obfuscation	package/dist/326.bundle.js	matched "fromCharCode"	3
low	Obfuscation	package/dist/535.bundle.js	matched "fromCharCode"	3
low	Obfuscation	package/dist/main.bundle.js	matched "\\u0600"	3
low	Obfuscation	package/dist/test.bundle.js	matched "\\u0600"	3
low	Obfuscation	package/dist/src/util/Validation.js	matched "\\u0600"	3
low	Obfuscation	package/dist/src/components/summary/BEMobileSummary.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/summary/BEMobileSummaryModal.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/summary/BESummaryAddonRow.js	matched "\\u00D7"	3
low	Obfuscation	package/dist/src/pages/findReservation/ReservationRow.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/pages/findReservation/ReservationRowModal.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/components/User/Forms/SignInForm.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/components/steps/confirmation/AccountDetails.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/confirmation/RoomContactDetails.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/date/PeoplePickerRow.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/date/StepOneStatusPeople.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/pages/account/ChangePassword/AccountChangePasswordPage.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/pages/account/Reservations/AccountReservationSinglePage.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/components/pages/Account/Card/MemberCardItem.js	matched "\\u2022"	3
low	Obfuscation	package/dist/src/components/steps/room/UserSearchSummary/UserSearchSummaryRow.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/room/roomBuilderProgress/RoomBuilderProgressRow.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/room/roomDetails/roomRates/PriceBreakdownBlock.js	matched "\\u00A0"	3
low	Obfuscation	package/dist/src/components/steps/room/roomDetails/unavailableRoom/UnavailableRoom.js	matched "\\u2014"	3

Manifest

Package metadata

Scripts24

buildrm -rf ./dist/; tsc;resolve-tspaths --src ./; env-cmd -f .env.prod webpack --mode production
build-storybookbuild-storybook
build:releaserm -rf ./dist/; tsc;resolve-tspaths --src ./; env-cmd -f .env.release webpack --mode production
build:stagingrm -rf ./dist/; env-cmd -f .env.staging webpack --mode production
clientsenv-cmd -f .env.local webpack-dev-server --open --mode development --hot --config 'webpack-clients.config.js'
devenv-cmd -f .env.local webpack-dev-server --open --mode development --hot --config 'webpack-local.config.js'
preparehusky install > /dev/null
prepublishOnly./rsbundler pack-for-release; echo 0;
releasenp
startnpm run dev
storybookenv-cmd -f .env.local start-storybook -p 6006
testnpm run test:prettier
test:coveragejest --coverage
test:linteslint 'src/**/*.{ts,tsx}' --quiet
test:lint-fixeslint --fix 'src/**/*.{ts,tsx}'
test:playwrightyarn playwright test
test:playwright:clientsCLIENTS=true yarn playwright test
test:playwright:reportyarn playwright show-report
test:playwright:uiyarn playwright test --ui
test:playwright:ui:clientsCLIENTS=true yarn playwright test --ui
test:prettierprettier --check 'src/**/*.{tsx,ts}' -c ./.prettierrc
test:prettier-fixprettier --write 'src/**/*.{tsx,ts}' -c ./.prettierrc
test:tsctsc --project ./tsconfig.json --noEmit
test:wdiodocker-compose -f docker-compose.test.yml up --build

Dependencies40

@adyen/adyen-web^6.8.0
@aws-amplify/auth^4.5.10
@googlemaps/react-wrapper^1.1.35
@juggle/resize-observer^3.4.0
@paypal/react-paypal-js^8.9.2
@planpay/web^1.1.2
@popperjs/core^2.11.6
@react-spring/web^9.4.4
@roomstay/core0.1.85
@roomstay/gc-frontend^1.0.10
@roomstay/ui^0.0.15
@sentry/browser^5.21.0
@sentry/types^5.26.0
@stripe/react-stripe-js^5.2.0
@stripe/stripe-js^8.0.0
@types/base-64^1.0.0
@types/react-helmet^6.1.11
@vgs/collect-js^0.6.1
base-64^1.0.0
classnames^2.2.6
csstype^3.1.3
dayjs^1.11.7
fslightbox-react^1.4.9
husky^8.0.3
i18next^19.6.3
lint-staged^13.1.1
react^16.12.0
react-dom^16.12.0
react-gtm-module^2.0.10
react-helmet^6.1.0
…and 10 more.