PkgRadar

Package evidence

@steipete/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
9,390Niche · −30% score
Versions published
45Established · −30% score
First published
Nov 2025
Publisher
steipete

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@steipete/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@steipete/[email protected]"],"fail_on":"review"}'
Publishersteipete
Artifact bytes7,207,251
Previous version0.13.0
Published2026-06-12T01:14:21.853Z
SHA-25603b84c6673f14b915d104e97cc19ccbcd4923137ebe0df7dfd4b486ae4b443ef

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
0.14.0Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts26
  • buildtsgo -p tsconfig.build.json && pnpm run build:vendor
  • build:vendornode -e "const fs=require('fs'); const path=require('path'); const vendorRoot=path.join('dist','vendor'); fs.rmSync(vendorRoot,{recursive:true,force:true}); const vendors=[['oracle-notifier']]; vendors.forEach(([name])=>{const src=path.join('vendor',name); const dest=path.join(vendorRoot,name); fs.mkdirSync(dest,{recursive:true}); if(fs.existsSync(src)){fs.cpSync(src,dest,{recursive:true,force:true});}});"
  • checkpnpm run format:check && pnpm run lint
  • docs:checknode --no-deprecation --import tsx bin/oracle-cli.ts docs check
  • docs:listtsx scripts/docs-list.ts
  • docs:sitenode scripts/build-docs-site.mjs
  • formatoxfmt --write .
  • format:checkoxfmt --check .
  • format:diffoxfmt --write . && git --no-pager diff
  • lintpnpm run typecheck && oxlint
  • lint:fixoxlint --fix && pnpm run format
  • mcppnpm run build && node ./dist/bin/oracle-mcp.js
  • oraclepnpm start
  • preparepnpm run build
  • startpnpm run build && node ./dist/scripts/run-cli.js
  • testvitest run
  • test:browserpnpm run build && tsx scripts/test-browser.ts && ./scripts/browser-smoke.sh
  • test:coveragevitest run --coverage
  • test:liveORACLE_LIVE_TEST=1 vitest run tests/live --exclude tests/live/openai-live.test.ts
  • test:live:fastORACLE_LIVE_TEST=1 ORACLE_LIVE_TEST_FAST=1 vitest run tests/live/browser-fast-live.test.ts
  • test:mcppnpm run build && pnpm run test:mcp:unit && pnpm run test:mcp:mcporter
  • test:mcp:mcporterCHROME_DEVTOOLS_URL=http://127.0.0.1:0 pnpm dlx mcporter list oracle-local --schema --config config/mcporter.json && CHROME_DEVTOOLS_URL=http://127.0.0.1:0 pnpm dlx mcporter call oracle-local.sessions limit:1 --config config/mcporter.json
  • test:mcp:unitvitest run tests/mcp*.test.ts tests/mcp/**/*.test.ts
  • test:packed-clinode scripts/packed-cli-smoke.mjs
  • test:proORACLE_LIVE_TEST=1 vitest run tests/live/openai-live.test.ts
  • typechecktsgo --noEmit
Dependencies24
  • @anthropic-ai/tokenizer^0.0.4
  • @google/genai^2.8.0
  • @google/generative-ai^0.24.1
  • @modelcontextprotocol/sdk^1.29.0
  • @steipete/sweet-cookie^0.3.0
  • chalk^5.6.2
  • chrome-launcher^1.2.1
  • chrome-remote-interface^0.34.0
  • clipboardy^5.3.1
  • commander^15.0.0
  • dotenv^17.4.2
  • fast-glob^3.3.3
  • gpt-tokenizer^3.4.0
  • inquirer14.0.2
  • json5^2.2.3
  • kleur^4.1.5
  • markdansi0.2.1
  • openai^6.42.0
  • osc-progress^0.3.0
  • qs^6.15.2
  • shiki^4.2.0
  • toasted-notifier^10.1.0
  • tokentally^0.1.1
  • zod^4.4.3