PkgRadar

Package evidence

@wise/[email protected]

Remote Dependency Spec: devDependencies.wise-atoms="git+https://github.com/transferwise/wise-atoms.git#df1faf0e4fcabde8a644434b8e7821cec96f986d"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
236Mature · −50% score
First published
Nov 2022
Publisher
npn_ci_wise

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@wise/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@wise/[email protected]"],"fail_on":"review"}'
Publishernpn_ci_wise
Artifact bytes64,337
Previous version2.31.0
Published2026-06-09T08:11:17.189Z
SHA-2564e85da139b68f095b1ccba1fccb282fe17c67612c6028e69149d31f917568b5d

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.wise-atoms="git+https://github.com/transferwise/wise-atoms.git#df1faf0e4fcabde8a644434b8e7821cec96f986d"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
4Score
2.31.1Version
Status history (1 event)
  1. new → available · risk review · score 4 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondevDependencies.wise-atoms="git+https://github.com/transferwise/wise-atoms.git#df1faf0e4fcabde8a644434b8e7821cec96f986d"8

Manifest

Package metadata

Scripts25
  • buildNODE_ENV=web-art-prod pnpm load-i10s && pnpm load-3d-i10s && pnpm convert-i10s-png-to-webp && pnpm generate-i10s-metadata && pnpm load-flags && pnpm generate-flags-metadata && pnpm bundle && pnpm cleanup
  • build-docsstorybook build --stats-json -o docs && touch ./docs/.nojekyll
  • build-stylespostcss src/index.css -o dist/Illustration.css
  • bundlerm -rf dist && rollup --config --sourcemap && pnpm build-styles
  • changesetchangeset
  • cleanuprm -rf temp
  • convert-flags-svg-to-pngnode ./scripts/convert-flags-svg-to-png.mjs
  • convert-i10s-png-to-webprm -rf s3-bucket/illustrations/ && copyfiles --f node_modules/wise-atoms/assets/illustrations/**/*.png s3-bucket/illustrations && node ./scripts/convert-png-to-webp.mjs
  • devNODE_ENV=web-art-dev pnpm start
  • generate-flags-metadatanode ./scripts/generate-flags-metadata.mjs && eslint 'src/flags/metadata.ts' --fix
  • generate-i10s-metadatanode ./scripts/generate-i10s-metadata.mjs && eslint 'src/illustrations/metadata.ts' --fix
  • linteslint 'src/**/*.{js,ts,tsx}' 'scripts/*.{mjs,js,ts,tsx}'
  • lint-fixeslint 'src/**/*.{js,ts,tsx}' 'scripts/*.{mjs,js,ts,tsx}' --fix
  • load-3d-i10srm -rf s3-bucket/illustrations3d/ && node ./scripts/load-3d-i10s.mjs && pnpm load-riv
  • load-country-flagscopyfiles -u 4 node_modules/wise-atoms/assets/flags/*.svg s3-bucket/flags && node ./scripts/generate-country-flags.mjs
  • load-currency-flagscopyfiles -u 4 node_modules/wise-atoms/assets/flags/_metadata.json s3-bucket/flags && node ./scripts/generate-currency-flags.mjs
  • load-flagsrm -rf s3-bucket/flags/* && pnpm load-country-flags && pnpm load-currency-flags && pnpm transform-flags && pnpm convert-flags-svg-to-png
  • load-i10scopyfiles -u 4 node_modules/wise-atoms/assets/illustrations/**/*.png temp
  • load-rivcopyfiles -u 1 assets/*.riv s3-bucket/illustrations3d/rive
  • releasechangeset publish
  • setuppnpm install && pnpm build
  • startstorybook dev -p 3001
  • testjest
  • test:watchjest --watch
  • transform-flagsnode ./scripts/transform-flags.mjs
Dependencies7
  • @babel/runtime^7.29.7
  • @react-three/drei9.122.0 || ^10.7.7
  • @react-three/fiber8.18.0 || ^9.5.0
  • @rive-app/react-webgl2^4.29.0
  • @types/three0.164.0
  • clsx^2.1.1
  • three0.164.0