PkgRadar

Package evidence

@zenbujs/[email protected]

Large Javascript Payload: 2442011 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
25
First published
May 2026
Publisher
robpruzan

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@zenbujs/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@zenbujs/[email protected]"],"fail_on":"review"}'
Publisherrobpruzan
Artifact bytes854,539
Previous version0.2.1
Published2026-05-28T03:20:40.661Z
SHA-2561cccfd459745d30a2b87b4985fe6bc5a074b3915c50f2f5470720a5462b6185c

Why flagged

What the scanner saw

Large Javascript Payload: 2442011 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
20Score
0.2.2Version
Status history (1 event)
  1. new → available · risk review · score 20 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/transform-czrcGnVV.mjs2442011 bytes10
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/transform-czrcGnVV.mjs2442011 bytes10
lowCredential file accesspackage/dist/build-electron-BfAhZ9B5.mjsmatched "GITHUB_TOKEN"5
lowCredential file accesspackage/dist/publish-source-l7u-nZ2V.mjsmatched "GITHUB_TOKEN"5

Manifest

Package metadata

Scripts7
  • buildnode --max-old-space-size=8192 ./node_modules/tsdown/dist/run.mjs
  • db:generatenode ./dist/cli/bin.mjs db generate --schema src/schema.ts --migrations ./migrations
  • devtsdown --watch
  • link:typestsx ./src/cli/bin.ts link --types-config ./zenbu-types.config.json --out ./src/registry-generated.ts --augment-out ./types/zenbu-register.ts
  • prebuildpnpm link:types
  • testvitest run
  • typechecktsc --noEmit -p tsconfig.json
Dependencies11
  • @parcel/watcher^2.5.0
  • @vitejs/plugin-react^5.0.0
  • @zenbujs/hmr0.0.2
  • effect^3.21.1
  • electron-context-menu^4.1.2
  • isomorphic-git^1.37.6
  • nanoid^5.1.6
  • semver^7.8.0
  • tsx4.19.4
  • vite^6.0.0
  • ws^8.18.0