Package evidence

@sap/[email protected]

Invalid Package Json: package.json is not valid JSON

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 80,774Mainstream · −50% score
Versions published: 148Mature · −50% score
First published: Jun 2020
Publisher: sap_extncrepos

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sap/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sap/[email protected]"],"fail_on":"review"}'

Publishersap_extncrepos

Artifact bytes12,351,059

Previous version1.25.0

Published2026-06-11T10:33:56.431Z

SHA-256d4c4c4578a085677d7de4a9f34cc9672f1bce03d49fffec4e0f850938dfe115d

Why flagged

What the scanner saw

Invalid Package Json: package.json is not valid JSON

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

2d agoLast checked

reviewRisk

3Score

1.26.0Version

Status history (1 event)

new → available2d ago · risk review · score 3 · status changed

Evidence

Static findings

9 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Invalid Package Json	package/dist/adp-tooling/templates/project/package.json	package.json is not valid JSON	10

Show all 9 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Invalid Package Json	package/dist/adp-tooling/templates/project/package.json	package.json is not valid JSON	10
low	Large Javascript Payload	package/dist/cli/index.cjs	11889866 bytes	0
low	Large Javascript Payload	package/dist/control-property-editor/app.js	2813797 bytes	0
low	Large Javascript Payload	package/dist/middlewares/fiori-tools-appreload.js	2214275 bytes	0
low	Large Javascript Payload	package/dist/middlewares/fiori-tools-preview.js	8784706 bytes	0
low	Large Javascript Payload	package/dist/middlewares/fiori-tools-proxy.js	7931909 bytes	0
low	Large Javascript Payload	package/dist/middlewares/fiori-tools-servestatic.js	2142848 bytes	0
low	Large Javascript Payload	package/dist/tasks/cf-deploy/index.js	6602875 bytes	0
low	Large Javascript Payload	package/dist/tasks/deploy/index.js	8253473 bytes	0

Manifest

Package metadata

Scripts24

buildnpm-run-all -l -s clean -p build:compile build:bundle build:copyTemplates1 build:copyTemplates2
build:bundlenode esbuild.js
build:compiletsc --build ./ --pretty --dry
build:copyTemplates1copyfiles --error --flat -V views/** ./dist/views
build:copyTemplates2copyfiles --error -V src/markdowns/**/*.* ./dist/ -u 1
build:depsyarn lerna run --concurrency 1 --no-bail --stream --scope @sap/ux-app-templates build
bundleyarn build:deps && yarn build && npm pack
cleanrimraf ./.webpack_cache
clean:distrimraf --glob ./dist ./generators ./prebuilds *.tsbuildinfo
format:fixprettier --write --loglevel silent --ignore-path ../../../.prettierignore
format:fix:allprettier --write '**/*.{css,scss,html,js,json,ts,tsx,yaml,yml}' '!**/{out,dist,typings,node_modules}/**' '!**/*.{svg,png,xml}' --ignore-path ../../../.prettierignore
linteslint .
lint:fixeslint --fix
lint:fix:alleslint . --fix
lint:reporteslint . -f multiple
lint:summaryeslint . -f summary
madgemadge --warning --circular --extensions ts --exclude dist ./
testcross-env NODE_OPTIONS="--experimental-vm-modules --trace-warnings" SAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY=true FIORI_TOOLS_DISABLE_SECURE_STORE=true jest --maxWorkers=1 --ci --forceExit --detectOpenHandles
test:cpe-integrationcross-env SAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY=true playwright test
test:cpe-integration-adpcross-env SAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY=true playwright test --project=ADP
test:cpe-integration-cpecross-env SAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY=true playwright test --project=CPE
test:sequencenode -r ts-node/register test/sample-project/app/request-sequence.ts
tgz:packagenpm pack
watchyarn clean && node esbuild --watch --minify=false