Package evidence

@xspswap/[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@xspswap/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@xspswap/[email protected]"],"fail_on":"review"}'

Publisherpro100skm

Artifact bytes509,519

Previous version1.1.5

Published2026-05-24T17:24:50.302Z

SHA-2563dbc5aa7c318897e8e1e20a988c81fb98b60845e047b936559944a4fb739a5eb

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

24Score

1.1.6Version

Status history (1 event)

new → available20d ago · risk review · score 24 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/build/main/util/unsupported-tokens.js	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/build/module/util/unsupported-tokens.js	matched "raw.githubusercontent.com"	12

Manifest

Package metadata

Scripts14

buildrun-p compile-v3-types compile-v2-types compile-router compile-external-types && run-p build:*
build:maintsc -p tsconfig.json
build:moduletsc -p tsconfig.module.json
compile-external-typesnpx typechain --target ethers-v5 --out-dir src/types/other 'src/abis/**/*.json'
compile-narwhalnpx typechain --target ethers-v5 --out-dir src/types/other './node_modules/@uniswap/narwhal/artifacts/contracts/**/*.json'
compile-routernpx typechain --target ethers-v5 --out-dir src/types/other './node_modules/@uniswap/swap-router-contracts/artifacts/contracts/**/*.json'
compile-v2-typesnpx typechain --target ethers-v5 --out-dir src/types/v2 './node_modules/@uniswap/?(v2-core|v2-periphery)/build/*UniswapV2*.json'
compile-v3-typesnpx typechain --target ethers-v5 --out-dir src/types/v3 './node_modules/@uniswap/?(v3-core|v3-periphery)/artifacts/contracts/**/*.json'
fixrun-s fix:*
fix:linteslint src --ext .ts --fix
fix:prettierprettier "src/**/*.ts" --write
integ-testTS_NODE=true jest test/integ
prepare-releaserun-s cov:check doc:html version doc:publish
testjest test/unit

Dependencies20

@uniswap/default-token-list^2.0.0
@uniswap/swap-router-contracts^1.3.0
@uniswap/token-lists^1.0.0-beta.25
@uniswap/universal-router^1.0.1
@x-swap-protocol/router-sdk^1.1.0
@x-swap-protocol/universal-router-sdk^1.1.0
@x-swap-protocol/v2-sdk^1.1.0
@x-swap-protocol/v3-sdk^1.1.0
async-retry^1.3.1
await-timeout^1.1.1
axios^0.21.1
bunyan^1.8.15
bunyan-blackhole^1.1.1
ethers^5.7.2
graphql^15.5.0
graphql-request^3.4.0
lodash^4.17.21
mnemonist^0.38.3
node-cache^5.1.2
stats-lite^2.2.0