Package evidence

@yrpri/[email protected]

Remote Dependency Spec: dependencies.bunyan-prettystream="git+https://github.com/rbjarnason/node-bunyan-prettystream.git"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 238Mature · −50% score
First published: Feb 2024
Publisher: robertbjarnason

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@yrpri/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@yrpri/[email protected]"],"fail_on":"review"}'

Publisherrobertbjarnason

Artifact bytes838,830

Previous version9.0.237

Published2026-05-28T11:56:33.167Z

SHA-256cba2a7c478a2a84645618058876defa9da689ab281c23d020fc45937870e9da6

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.bunyan-prettystream="git+https://github.com/rbjarnason/node-bunyan-prettystream.git"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

54Score

9.0.238Version

Status history (1 event)

new → available20d ago · risk review · score 54 · status changed

Evidence

Static findings

16 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.bunyan-prettystream="git+https://github.com/rbjarnason/node-bunyan-prettystream.git"	12
medium	Remote Dependency Spec	package.json	dependencies.express-session="git+https://github.com/rbjarnason/session.git#upgrade-21"	12
medium	Remote Dependency Spec	package.json	dependencies.passport-openidconnect="git+https://github.com/rbjarnason/passport-openidconnect.git"	12
medium	Remote Dependency Spec	package.json	dependencies.passport-sso="github:rbjarnason/passport-sso#a3f8aa7523fd72eb2221db72eb72a81bf1a7c148"	12

Show all 16 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.bunyan-prettystream="git+https://github.com/rbjarnason/node-bunyan-prettystream.git"	12
medium	Remote Dependency Spec	package.json	dependencies.express-session="git+https://github.com/rbjarnason/session.git#upgrade-21"	12
medium	Remote Dependency Spec	package.json	dependencies.passport-openidconnect="git+https://github.com/rbjarnason/passport-openidconnect.git"	12
medium	Remote Dependency Spec	package.json	dependencies.passport-sso="github:rbjarnason/passport-sso#a3f8aa7523fd72eb2221db72eb72a81bf1a7c148"	12
low	Credential file access	package/controllers/groups.cjs	matched "AWS_SECRET_ACCESS_KEY"	5
low	Credential file access	package/controllers/images.cjs	matched "AWS_SECRET_ACCESS_KEY"	5
low	Credential file access	package/controllers/points.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/controllers/users.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/controllers/videos.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/models/audio.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/models/video.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/services/models/ac_translation_cache.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/services/workers/speech_to_text.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/services/engine/reports/commonUtils.js	matched "AWS_SECRET_ACCESS_KEY"	5
low	Credential file access	package/services/engine/reports/common_utils.cjs	matched "AWS_SECRET_ACCESS_KEY"	5
low	Credential file access	package/services/engine/moderation/image_labeling/ImageLabelingBase.cjs	matched "GOOGLE_APPLICATION_CREDENTIALS"	5

Manifest

Package metadata

Scripts12

buildtsc --outDir ./dist && ncp src/views dist/views && ncp config dist/config && ncp src/services/email_templates dist/services/email_templates && ncp src/services/locales dist/services/locales
build:devtsc --outDir ./ts-out && ncp src/views ts-out/views && ncp config ts-out/config && ncp src/services/email_templates ts-out/services/email_templates && ncp src/services/locales ts-out/services/locales
copyInLocalAgentscp -R ../../policy-synth/agents/ts-out/* ./node_modules/@policysynth/agents/;cp ../../policy-synth/agents/src/*.d.ts ./node_modules/@policysynth/agents/;
devnodemon --config nodemon.json ./ts-out/server.js
dev:debugnodemon --config nodemon.json --inspect-brk api_app.ts
heroku-postbuildecho 'Skipping build'
publish_livenpm run build:dev;npm pack && node repack && node publish.js https://registry.npmjs.org/
publish_live_with_copynpm run build:dev;copyfiles './src/utils/**/*.d.ts' './src/controllers/**/*.d.ts' './src/agents/**/*.d.ts' './src/models/**/*.d.ts' './src/services/controllers/**/*.d.ts' './src/services/models/**/*.d.ts' 'ts-out/';npm pack && node repack && node publish.js https://registry.npmjs.org/
publish_localnpm run build;npm pack && node repack && node publish.js http://localhost:4873
startnodemon -e ts ts-out/server.js
testnode --test ./src/tests/*.test.cjs
watch-startDEBUG=router:* tsc --outDir ./ts-out -w & nodemon -q ./ts-out/server.js

Dependencies75

@airbrake/node^2.1.9
@aws-sdk/client-s3^3.1029.0
@google-cloud/aiplatform^6.8.0
@google-cloud/speech^7.3.1
@google-cloud/storage^7.19.0
@google-cloud/translate^9.4.1
@google-cloud/vertexai^1.10.0
@google-cloud/vision^5.3.6
@node-saml/passport-saml^5.1.0
@policysynth/agents^1.3.185
async^3.2.6
authorized^1.0.0
aws-sdk^2.1693.0
axios^1.16.1
bcrypt^6.0.0
body-parser^2.2.2
bullmq^5.31.0
bunyan^1.8.15
bunyan-prettystreamgit+https://github.com/rbjarnason/node-bunyan-prettystream.git
cheerio^1.0.0
color-hash^2.0.2
compression^1.8.1
concat-stream^2.0.0
connect-redis^9.0.0
cors^2.8.6
deep-equal^2.2.3
docx^9.6.1
download-file^0.1.5
ejs^5.0.2
exceljs^4.4.0
…and 45 more.