Package evidence

@uh-design-system/[email protected]

Large Javascript Payload: 2049972 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,286Niche · −30% score
Versions published: 77Mature · −50% score
First published: Nov 2024
Publisher: tparssinen

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@uh-design-system/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@uh-design-system/[email protected]"],"fail_on":"review"}'

Publishertparssinen

Artifact bytes2,473,197

Previous version1.5.2-rc.1

Published2026-05-18T07:22:20.793Z

SHA-256aedcb8928feafcff695b00565d6030cf26564120b476f4a221324d3c0a7cc667

Why flagged

What the scanner saw

Large Javascript Payload: 2049972 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17d agoLast checked

reviewRisk

10Score

1.5.2Version

Status history (1 event)

new → available17d ago · risk review · score 10 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/hydrate/index.js	2049972 bytes	10
medium	Large Javascript Payload	package/dist/hydrate/index.mjs	2049712 bytes	10

Manifest

Package metadata

Scripts24

buildrun-s styles.write-version stencil.build storybook.build styles.build
build:publishrun-s styles.write-version stencil.build styles.build
developcross-env SKIP_REACT_OUTPUT=y run-p styles.write-version stencil.build:watch storybook.dev
eslint.linteslint --ext .ts,.tsx,.js,.jsx ./src
icons.generatets-node ./scripts/generate-icons.ts
lintrun-p eslint.lint stylelint.lint
prettier.checknpx prettier "{stencil.config.ts,{.storybook,scripts,src}/**/*.{scss,js,jsx,ts,tsx}}" --check
prettier.writenpx prettier "{stencil.config.ts,{.storybook,scripts,src}/**/*.{scss,js,jsx,ts,tsx}}" --write
stencil.buildstencil build
stencil.build:servestencil build --watch --serve
stencil.build:watchstencil build --watch
stencil.generatestencil generate
stencil.teststencil test --spec
stencil.test:watchstencil test --spec --watchAll
storybook.buildstorybook build
storybook.devstorybook dev -p 6006
storybook.testtest-storybook
storybook.test:updaterm -rf __snapshots__ && storybook.test -- -u
stylelint.lintstylelint ./src/**/*.scss
styles.buildrun-s styles.build:helpers styles.build:variables
styles.build:helperssass src/styles/helpers.scss dist/styles/helpers.css
styles.build:variablessass src/styles/variables.scss dist/styles/variables.css
styles.write-versionts-node ./scripts/write-package-version-for-sass.ts
versionnpm run build:publish