Package evidence

@xspswap/[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@xspswap/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@xspswap/[email protected]"],"fail_on":"review"}'

Publisherpro100skm

Artifact bytes508,473

Previous version1.2.1-beta.16

Published2026-02-08T09:42:08.481Z

SHA-256314da9720e1380af1be5c93690f1d7239706773135a3956fdb208b2d9713804a

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

24Score

1.2.1-beta.17Version

Status history (1 event)

new → available20d ago · risk review · score 24 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/build/main/util/unsupported-tokens.js	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/build/module/util/unsupported-tokens.js	matched "raw.githubusercontent.com"	12

Manifest

Package metadata

Scripts18

buildrun-p compile-v3-types compile-v2-types compile-router compile-external-types && run-p build:*
build:maintsc -p tsconfig.json
build:moduletsc -p tsconfig.module.json
check-cgo-usdc./bin/cli quote --tokenIn 0x8f9920283470F52128bF11B0c14E798bE704fD15 --tokenOut 0xfA2958CB79b0491CC627c1557F441eF849Ca8eb1 --amount 10 --exactIn --minSplits 1 --distributionPercent 5 --maxSplits 5 --maxSwapsPerPath 5 --protocols uni-v3,v3,v2,fathom,mixed --router alpha --chainId 50
check-srx-usdc./bin/cli quote --tokenIn 0x5D5f074837f5d4618B3916ba74De1Bf9662a3fEd --tokenOut 0xfA2958CB79b0491CC627c1557F441eF849Ca8eb1 --amount 1000 --exactIn --minSplits 1 --distributionPercent 5 --maxSplits 5 --maxSwapsPerPath 5 --protocols uni-v3,v3,v2,fathom,mixed --router alpha --chainId 50
check-usdc-gama./bin/cli quote --tokenIn 0xfA2958CB79b0491CC627c1557F441eF849Ca8eb1 --tokenOut 0x3a170C7C987F55C84f28733Bfa27962D8CdD5D3B --amount 1000 --exactIn --minSplits 1 --distributionPercent 5 --maxSplits 5 --maxSwapsPerPath 5 --protocols uni-v3,v3,v2,fathom,mixed --router alpha --chainId 50
compile-external-typesnpx typechain --target ethers-v5 --out-dir src/types/other 'src/abis/**/*.json'
compile-narwhalnpx typechain --target ethers-v5 --out-dir src/types/other './node_modules/@uniswap/narwhal/artifacts/contracts/**/*.json'
compile-routernpx typechain --target ethers-v5 --out-dir src/types/other './node_modules/@uniswap/swap-router-contracts/artifacts/contracts/**/*.json'
compile-v2-typesnpx typechain --target ethers-v5 --out-dir src/types/v2 './node_modules/@uniswap/?(v2-core|v2-periphery)/build/*UniswapV2*.json'
compile-v3-typesnpx typechain --target ethers-v5 --out-dir src/types/v3 './node_modules/@uniswap/?(v3-core|v3-periphery)/artifacts/contracts/**/*.json'
fast-check./bin/cli quote --tokenIn 0xfA2958CB79b0491CC627c1557F441eF849Ca8eb1 --tokenOut 0x8f9920283470F52128bF11B0c14E798bE704fD15 --amount 1000 --exactIn --minSplits 1 --maxSplits 5 --maxSwapsPerPath 5 --protocols uni-v3,v3,v2,fathom,mixed --router alpha --chainId 50
fixrun-s fix:*
fix:linteslint src --ext .ts --fix
fix:prettierprettier "src/**/*.ts" --write
integ-testTS_NODE=true jest test/integ
prepare-releaserun-s cov:check doc:html version doc:publish
testjest test/unit

Dependencies20

@uniswap/default-token-list^2.0.0
@uniswap/swap-router-contracts^1.3.0
@uniswap/token-lists^1.0.0-beta.25
@x-swap-protocol/router-sdk^1.2.10
@x-swap-protocol/sdk-core^1.0.4
@x-swap-protocol/universal-router-sdk^1.1.14
@x-swap-protocol/v2-sdk^1.2.7
@x-swap-protocol/v3-sdk^1.1.3
async-retry^1.3.1
await-timeout^1.1.1
axios^0.21.1
bunyan^1.8.15
bunyan-blackhole^1.1.1
ethers^5.7.2
graphql^15.5.0
graphql-request^3.4.0
lodash^4.17.21
mnemonist^0.38.3
node-cache^5.1.2
stats-lite^2.2.0