Package evidence

@sovovs/[email protected]

Known Indicator Filename: package/dist/src/browser/stealth.js

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: sovovs

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sovovs/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sovovs/[email protected]"],"fail_on":"high"}'

Publishersovovs

Artifact bytes2,156,816

Previous versionnone

Published2026-06-12T05:51:58.485Z

SHA-2565ca8074045d513b9d40f5aa0b8c14bd7d4455cf02f338d54a9ac66feffd33269

Why flagged

What the scanner saw

Known Indicator Filename: package/dist/src/browser/stealth.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

8h agoLast checked

highRisk

70Score

1.8.0Version

Status history (1 event)

new → available8h ago · risk high · score 70 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/dist/src/browser/stealth.js	package/dist/src/browser/stealth.js	45
high	New Account With Lifecycle Hook	package.json	package first published 0 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="node scripts/postinstall.js \|\| true; node scripts/fetch-adapters.js \|\| true"	20

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/dist/src/browser/stealth.js	package/dist/src/browser/stealth.js	45
high	New Account With Lifecycle Hook	package.json	package first published 0 day(s) ago, 1 total version(s), has lifecycle hook	25
high	Install Lifecycle Suppresses Failure	package.json	postinstall="node scripts/postinstall.js \|\| true; node scripts/fetch-adapters.js \|\| true"	20
low	Install-time lifecycle script	package.json	postinstall="node scripts/postinstall.js \|\| true; node scripts/fetch-adapters.js \|\| true"	5

Manifest

Package metadata

Scripts25

advise:listing-id-pairingnode scripts/check-listing-id-pairing.mjs
buildnpm run clean-dist && npm run copy-yaml && npm run build-manifest
build-manifesttsx src/build-manifest.ts
check:silent-column-dropnode scripts/check-silent-column-drop.mjs
check:typed-error-lintnode scripts/check-typed-error-lint.mjs
clean-distnode scripts/clean-dist.cjs
copy-yamlnode scripts/copy-yaml.cjs
devtsx src/main.ts
dev:bunbun src/main.ts
docs:buildvitepress build docs
docs:devvitepress dev docs
docs:previewvitepress preview docs
postinstallnode scripts/postinstall.js || true; node scripts/fetch-adapters.js || true
prebuild-manifesttsc --build && node -e "require('fs').chmodSync('dist/src/main.js', 0o755)"
prepare[ -d src ] && npm run build || true
prepublishOnlynpm run build
preuninstallnode -e "fetch('http://127.0.0.1:'+(process.env.BYCLI_DAEMON_PORT||'19825')+'/shutdown',{method:'POST',headers:{'X-byCLI':'1'},signal:AbortSignal.timeout(3000)}).catch(()=>{})" || true
startnode dist/src/main.js
start:bunbun dist/src/main.js
testvitest run --project unit --project extension --project adapter
test:adaptervitest run --project adapter
test:allvitest run
test:bunbun vitest run --project unit --project extension --project adapter
test:e2evitest run --project e2e
typechecktsc --noEmit

Dependencies8

@mozilla/readability^0.6.0
cli-table3^0.6.5
commander^14.0.3
js-yaml^4.1.0
turndown^7.2.2
turndown-plugin-gfm^1.0.2
undici^6.25.0
ws^8.18.0