Package evidence

@system-inc/[email protected]

Suspicious Publish Context: {"package_age_days":0,"publisher":"kamsheffield","burst_same_day":0,"burst_week":0,"lure":{"kind":"token_affix","target":"type"},"version_anomaly":false,"new_account":false}

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: kamsheffield

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@system-inc/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@system-inc/[email protected]"],"fail_on":"review"}'

Publisherkamsheffield

Artifact bytes57,456

Previous versionnone

Published2026-06-17T23:25:48.880Z

SHA-25651f5b3052bdce049ddfbc16285b6d35c74c6bb213434e9ecf7a165e807e77135

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

13h agoLast checked

reviewRisk

10Score

2.0.0-rc.3Version

Status history (1 event)

new → available13h ago · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"kamsheffield","burst_same_day":0,"burst_week":0,"lure":{"kind":"token_affix","target":"type"},"version_anomaly":false,"new_account":false}	10

Manifest

Package metadata

Scripts41

buildnpx tsc --build ./tsconfig.cjs.json ./tsconfig.esm.json ./tsconfig.typings.json
build:benchmarksnpx tsc --build ./benchmarks/tsconfig.json
checknpx npm-run-all --npm-path npm "check:*"
check:benchmarksnpx tsc --project ./benchmarks/tsconfig.json --noEmit
check:examplesnpx tsc --project ./examples/tsconfig.json --noEmit
check:formatnpx prettier --check .
check:lintnpx eslint .
check:markdownnpx markdownlint "**/*.md"
check:scriptnpx shellcheck ./.husky/pre-commit
check:scriptsnpx tsc --project ./scripts/tsconfig.json --noEmit
check:spellnpx cspell lint --config cspell.json --no-progress --show-context "**"
check:typenpx npm-run-all --npm-path npm "check:type:*"
check:type:cjsnpx tsc --project ./tsconfig.cjs.json --noEmit
check:type:esmnpx tsc --project ./tsconfig.esm.json --noEmit
check:type:testsnpx tsc --project ./tests/tsconfig.json --noEmit
check:type:typingsnpx tsc --project ./tsconfig.typings.json --noEmit --emitDeclarationOnly false
check:versionnpx ts-node ./scripts/version.ts
cleannpx npm-run-all --npm-path npm "clean:*"
clean:buildnpx shx rm -rf ./build
clean:build:benchmarksnpx shx rm -rf ./benchmarks/build
clean:coveragenpx shx rm -rf ./coverage
docsnpm run start --prefix website
fixnpx npm-run-all --npm-path npm "fix:*"
fix:formatnpx prettier --write .
fix:lintnpx eslint --fix .
fix:markdownnpx markdownlint --fix "**/*.md"
gen:docsnpx ts-node ./scripts/markdown.ts --on docs
gen:readmenpx ts-node ./scripts/markdown.ts --on readme
gen:sponsorkitnpx sponsorkit --width=320 --dir=./images --name=github-sponsors
postbuildnpx shx rm ./build/typings/shim.d.ts && npx shx cp ./src/shim.ts ./build/typings && npx ts-node ./scripts/package.json.ts
…and 11 more.

Dependencies3

@types/node*
graphql-query-complexity^1.0.0
tslib^2.6.3