PkgRadar

Package evidence

@yahoo/[email protected]

Large Javascript Payload: 4501254 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,573Niche · −30% score
Versions published
487Mature · −50% score
First published
Nov 2023
Publisher
hamza.khchichine

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@yahoo/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@yahoo/[email protected]"],"fail_on":"review"}'
Publisherhamza.khchichine
Artifact bytes3,308,530
Previous version3.148.0
Published2026-05-27T18:51:52.053Z
SHA-25688f26165557973e0f55874cf32db8cc7ce64b6fa1725f18cae38545e65b77043

Why flagged

What the scanner saw

Large Javascript Payload: 4501254 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
3.149.0Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/tailwind-internal/dist/vendor/tailwindcss/peers/index.js4501254 bytes10

Manifest

Package metadata

Scripts21
  • buildNODE_OPTIONS="--max-old-space-size=12288" bun run ./scripts/build.ts
  • ci:publishbun semantic-release
  • cleanrm -rf .turbo && rm -rf node_modules && rm -rf dist && rm -rf .coverage
  • devconcurrently bun:dev:*
  • dev:fixturesbun run ./scripts/buildFixtures.ts --watch
  • dev:tstsdown --watch
  • format:pkgbun --cwd ../../ syncpack format
  • generate:componentDatabun run ../css/scripts/generateComponentData.ts --components-dir src/components --output generated/componentData.json
  • generate:purgeCSSDatacd ../tailwind-v3 && bun run ./scripts/generatePurgeCSSData.ts --tsconfig ../uds/tsconfig.json --variants ../uds/src/styles/variants.ts --components ../uds/src/components/index.ts --experimental-components ../uds/src/components/experimental/index.ts --output ../uds/generated/tailwindPurge.ts
  • linteslint -c eslint.config.mjs .
  • lint:fixbun run lint --fix
  • lint:pkgbun publint
  • testvitest run
  • test:coveragevitest run --coverage
  • test:e2ebun run e2e/verifyCLI.ts && bun run e2e/enforcePublicImportsAPI.ts
  • test:uivitest --ui --coverage
  • test:updatevitest run -u
  • test:watchvitest
  • typecheckconcurrently bun:typecheck:*
  • typecheck:scriptstsc -p ./scripts --noEmit
  • typecheck:udstsc -p . --noEmit
Dependencies18
  • @ariakit/react^0.4.25
  • autoprefixer^10.5.0
  • clsx^2.1.1
  • culori^4.0.2
  • fast-glob^3.3.3
  • lodash^4.18.1
  • lodash-es^4.17.23
  • motion^12.38.0
  • postcss^8.5.6
  • postcss-prune-var^1.1.2
  • postcss-scope^1.7.4
  • prompts^2.4.2
  • react-toastify^11.0.5
  • semver^7.7.4
  • simple-update-notifier^2.0.0
  • tailwind-merge^2.6.0
  • ts-morph^26.0.0
  • type-fest^5.5.0