Package evidence

@spothero/[email protected]

Install-time lifecycle script: preinstall="npx npm-force-resolutions || echo 1"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 455Mature · −50% score
First published: Aug 2018
Publisher: sh-npm-ci

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@spothero/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@spothero/[email protected]"],"fail_on":"review"}'

Publishersh-npm-ci

Artifact bytes8,182,004

Previous version13.7.0

Published2022-01-25T20:53:40.528Z

SHA-25690c11fed8c8f428f79c3231823a0d96240f1d8b9918fac645460f4028969ea81

Why flagged

What the scanner saw

Install-time lifecycle script: preinstall="npx npm-force-resolutions || echo 1"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

5h agoLast checked

reviewRisk

1Score

13.8.0-beta.0Version

Status history (1 event)

new → available5h ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	preinstall="npx npm-force-resolutions \|\| echo 1"	5

Manifest

Package metadata

Scripts21

buildnpm run clean && npm run clone:styles && npm run build:backlog && npm run build:v1 && npm run build:v2
build:backlogNODE_ENV=production babel src -d backlog --ignore "**/*.spec.js","**/stories/**","**/v2/**"
build:storybookbuild-storybook -o ./docs
build:v1rollup --config rollup/v1.config.js
build:v2rollup --config rollup/v2.config.js
cleanrm -rf docs v1 v2 backlog lib styles || true
clone:stylesrsync -a src/ styles && rm -rf styles/**/*.{js,jsx} styles/**/stories
cy:opencypress open
cy:runcypress run
linteslint .storybook src --ext .jsx,.js
preinstallnpx npm-force-resolutions || echo 1
prepublishOnlynpm run build
pretestnpm run build:storybook
releasenpm-release
release:storybooknpm run build:storybook && push-dir --dir=docs --branch=gh-pages --allow-unclean
startstart-storybook -p 6006
start:cihttp-server ./docs --port 8000 --silent
teststart-server-and-test start:ci http://localhost:8000 cy:run
test:templateNODE_ENV=test jest --config ./jest.config.json
test:unitnpm run test:template -- --coverage
test:unit:watchDEBUG_PRINT_LIMIT=-1 npm run test:template -- --watch

Dependencies26

@chakra-ui/react1.6.12
@chakra-ui/theme1.7.0
@chakra-ui/theme-tools1.1.0
@emotion/react11.1.5
@emotion/styled11.1.5
@spothero/utils8.7.0
@storybook/addon-a11y6.3.4
axe-core4.1.3
chartist0.11.4
chartist-plugin-legend0.6.2
chartist-plugin-tooltips0.0.17
core-js3.6.5
embla-carousel-react5.0.1
form-serialize0.7.2
framer-motion4.1.17
react-collapse4.0.3
react-day-picker7.3.2
react-input-mask2.0.4
react-lazy-load3.0.13
react-motion0.5.2
react-tether2.0.4
regenerator-runtime0.13.7
scrollingelement1.5.2
ssr-window1.0.1
transitionEnd1.0.2
uuid3.3.3