Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@wordpress-flow/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@wordpress-flow/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Large Javascript Payload: 4476275 bytes
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 10 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Large Javascript Payload | package/dist/index.js | 4476275 bytes | 10 |
Manifest
Package metadata
Scripts1
buildbun build ./src/index.ts --outdir ./dist --target node --external esbuild && bun build ./src/build/block-build-worker.ts --outfile ./dist/build/block-build-worker.js --target node --external esbuild
Dependencies21
@babel/core^7.28.4@babel/preset-react^7.27.1@mdx-js/mdx^3.1.1@mdx-js/react^3.1.1@types/react^18.3.24@types/wordpress__block-editor^11.5.17@wordpress/block-editor^15.4.0@wordpress/block-serialization-default-parser^5.33.0@wordpress/blocks^15.6.0@wordpress/element^6.33.0ajv^8.17.1axios^1.12.2chalk^4.1.2chokidar^3.5.3commander^11.0.0dotenv^17.2.3esbuild^0.19.0glob^11.0.3mysql2^3.15.2react^18.3.1react-dom^18.3.1