Package evidence

@twinmatrix/[email protected]

Remote Dependency Spec: dependencies.@mapbox/mapbox-gl-draw="github:hamzzam/mapbox-gl-draw#v1.4.1-touch-events-hotfix"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 10
First published: Jan 2026
Publisher: spatialverse-npm

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@twinmatrix/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@twinmatrix/[email protected]"],"fail_on":"review"}'

Publisherspatialverse-npm

Artifact bytes2,739,260

Previous version3.1.4

Published2026-03-17T22:48:30.014Z

SHA-25624bf2c3526ddcb3895bbf77b47c6b54d530f9df6f05987130621736091b9c4cf

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.@mapbox/mapbox-gl-draw="github:hamzzam/mapbox-gl-draw#v1.4.1-touch-events-hotfix"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

12h agoLast checked

reviewRisk

12Score

3.1.5Version

Status history (1 event)

new → available12h ago · risk review · score 12 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.@mapbox/mapbox-gl-draw="github:hamzzam/mapbox-gl-draw#v1.4.1-touch-events-hotfix"	12

Show all 5 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.@mapbox/mapbox-gl-draw="github:hamzzam/mapbox-gl-draw#v1.4.1-touch-events-hotfix"	12
low	Large Javascript Payload	package/lib/cjs/index.js	2336340 bytes	0
low	Large Javascript Payload	package/lib/cjs/react/index.js	2349413 bytes	0
low	Large Javascript Payload	package/lib/esm/index.js	2334807 bytes	0
low	Large Javascript Payload	package/lib/esm/react/index.js	2348935 bytes	0

Manifest

Package metadata

Scripts7

buildnpm-run-all -l clean -p build:esm build:cjs declarations
build:bundlescross-env BABEL_ENV=esmBundled rollup -c
build:cjsrollup -c rollup.config.single.js
build:esmrollup -c rollup.config.single.js
cleanrimraf lib
declarationstsc -p tsconfig.json || true
testjest

Dependencies36

@dagrejs/graphlib^2.2.4
@deck.gl/aggregation-layers^9.2.6
@deck.gl/geo-layers^9.2.6
@loaders.gl/gis^4.3.4
@loaders.gl/schema^4.3.4
@mapbox/mapbox-gl-drawgithub:hamzzam/mapbox-gl-draw#v1.4.1-touch-events-hotfix
@turf/area6.5.0
@turf/bbox6.5.0
@turf/boolean-disjoint6.5.0
@turf/boolean-point-in-polygon6.5.0
@turf/center6.5.0
@turf/centroid6.5.0
@turf/clean-coords6.5.0
@turf/distance6.5.0
@turf/helpers6.5.0
@turf/invariant6.5.0
@turf/length6.5.0
@turf/line-intersect6.5.0
@turf/line-slice6.5.0
@turf/line-slice-along6.5.0
@turf/meta6.5.0
@turf/nearest-point-on-line^7.0.0
@turf/transform-translate^7.0.0
@types/mapbox__mapbox-gl-draw^1.3.3
axios^1.3.4
firebase^10.12.2
geojson-rbush^3.2.0
gsap^3.13.0
jquery^3.6.1
lodash^4.17.21
…and 6 more.