Package evidence

@startale-scs/[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,065Niche · −30% score
Versions published: 20Mature · −50% score
First published: May 2025
Publisher: chiragtitiya6893

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@startale-scs/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@startale-scs/[email protected]"],"fail_on":"review"}'

Publisherchiragtitiya6893

Artifact bytes226,156

Previous version1.0.12

Published2026-04-28T08:03:18.729Z

SHA-2564dc8679779ab3883993057f8b1258c3458ea50bfcc27adeffd21c699c80479d5

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

6Score

1.0.13Version

Status history (1 event)

new → available15d ago · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/_esm/account/utils/getAAError.js	matched "raw.githubusercontent.com"	12

Manifest

Package metadata

Scripts29

buildbun run clean && bun run build:cjs && bun run build:esm && bun run build:types
build:cjstsc --project ./tsconfig/tsconfig.cjs.json && tsc-alias -p ./tsconfig/tsconfig.cjs.json && echo > ./dist/_cjs/package.json '{"type":"commonjs"}'
build:esmtsc --project ./tsconfig/tsconfig.esm.json && tsc-alias -p ./tsconfig/tsconfig.esm.json && echo > ./dist/_esm/package.json '{"type": "module","sideEffects":false}'
build:typestsc --project ./tsconfig/tsconfig.types.json && tsc-alias -p ./tsconfig/tsconfig.types.json
changesetchangeset
changeset:releasebun run build && changeset publish
changeset:release:canaryoriginal_name=$(bun run scripts/publish:canary.ts | grep ORIGINAL_NAME | cut -d'=' -f2) && npm publish && git checkout package.json && git tag -l '*-canary.*' | xargs git tag -d && git fetch --tags && git reset --hard && git clean -fd && echo "Published canary version of $original_name as latest"
changeset:versionchangeset version && bun install --lockfile-only
cjs:watchtsc --project ./tsconfig/tsconfig.cjs.json --watch
cjs:watch:aliasestsc-alias -p ./tsconfig/tsconfig.cjs.json --watch
cleanrimraf ./dist/_esm ./dist/_cjs ./dist/_types ./dist/tsconfig
coveragevitest run -c ./src/test/vitest.config.ts --coverage
devbun run build && bun link && concurrently "bun run esm:watch" "bun run cjs:watch" "bun run esm:watch:aliases" "bun run cjs:watch:aliases"
docstypedoc --tsconfig ./tsconfig/tsconfig.esm.json
docs:deploybun run docs && gh-pages -d docs
esm:watchtsc --project ./tsconfig/tsconfig.esm.json --watch
esm:watch:aliasestsc-alias -p ./tsconfig/tsconfig.esm.json --watch
fetch:deploymentbun run ./scripts/fetch:deployment.ts && bun run lint --apply-unsafe
fetch:deployment:rawbun run ./scripts/fetch:deployment.ts
fetch:tokenMapbun run scripts/fetch:tokenMap.ts && bun run lint:fix
formatbiome format . --write
fund:smartAccountbun run ./scripts/fund:smartAccount.ts
lintbiome check .
lint:fixbun run lint --apply
playgroundRUN_PLAYGROUND=true vitest -c ./src/test/vitest.config.ts -t=playground
playground:watchRUN_PLAYGROUND=true bun run test -t=playground --watch
sizesize-limit
testvitest run -c ./src/test/vitest.config.ts
test:watchvitest --watch -c ./src/test/vitest.config.ts