PkgRadar

Package evidence

@toa.io/[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
112
Versions published
315Mature · −50% score
First published
Mar 2023
Publisher
agurtovoi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@toa.io/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@toa.io/[email protected]"],"fail_on":"review"}'
Publisheragurtovoi
Artifact bytes1,226,381
Previous version1.0.0-alpha.211
Published2026-05-17T18:10:23.528Z
SHA-256802ea98784c3dd05ca3e8b85698e5a54f48eb7e71f6f0079398b9ed48e4841ca

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
1.0.0-alpha.212Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts13
  • featurescucumber-js
  • features:octetscucumber-js features/octets.*
  • features:securitycucumber-js --tags @security
  • testjest
  • transpiletsc && npm run transpile:bans && npm run transpile:basic && npm run transpile:tokens && npm run transpile:roles && npm run transpile:federation && npm run transpile:keys && npm run transpile:passkeys && npm run transpile:otp
  • transpile:banstsc -p ./components/identity.bans
  • transpile:basictsc -p ./components/identity.basic
  • transpile:federationtsc -p ./components/identity.federation
  • transpile:keystsc -p ./components/identity.keys
  • transpile:otptsc -p ./components/identity.otp
  • transpile:passkeystsc -p ./components/identity.passkeys
  • transpile:rolestsc -p ./components/identity.roles
  • transpile:tokenstsc -p ./components/identity.tokens
Dependencies16
  • @aws-sdk/protocol-http3.370.0
  • @simplewebauthn/server13.1.1
  • @toa.io/core1.0.0-alpha.212
  • @toa.io/generic1.0.0-alpha.208
  • @toa.io/schemas1.0.0-alpha.208
  • bcryptjs2.4.3
  • error-value0.4.2
  • jose5.10.0
  • js-yaml4.1.1
  • lru-cache11.2.7
  • matchacho0.3.5
  • minimatch10.2.4
  • msgpackr1.11.9
  • negotiator1.0.0
  • openspan1.0.0-alpha.173
  • paseto3.1.4