Package evidence

@zeniai/[email protected]

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 15 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 4,397Mature · −50% score
First published: Aug 2020
Publisher: nikunj1729

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@zeniai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@zeniai/[email protected]"],"fail_on":"review"}'

Publishernikunj1729

Artifact bytes3,588

Previous version5.1.19

Published2026-06-12T15:13:04.429Z

SHA-256b7e496b0e65f698a15f1c9c6cece181fccc59f0407dbe02e74e4c9bb41d5c2db

Why flagged

What the scanner saw

Manifest Codeless Dependency Stub: package ships no JS/TS source but declares 15 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

6h agoLast checked

reviewRisk

4Score

5.1.20-betaDI1Version

Status history (1 event)

new → available6h ago · risk review · score 4 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Manifest Codeless Dependency Stub	package.json	package ships no JS/TS source but declares 15 dependency(ies) (0 with loose/empty version specs) — dependency-confusion / install-chain loader shape	15

Manifest

Package metadata

Scripts33

buildconcurrently --kill-others-on-fail --handle-input "echo 'TypeScript build in progress...' && time tsc && echo 'ESM build...' && tsc -p tsconfig.esm.json" "echo 'Running tests and typecheck (incl. lint-modified-files)...' && pnpm test" && rimraf "lib/**/__mocks__" "lib/**/__testHelpers__"
build-beta-and-copychmod +x ./scripts/build_and_copy.sh && ./scripts/build_and_copy.sh
bump-update-web-app-cockpit-betachmod +x ./scripts/bump_and_update_web_app_ui_beta.sh && ./scripts/bump_and_update_web_app_ui_beta.sh
check-dependenciesnode ./scripts/check_dependencies.js
check-versionnode ./scripts/check_version.js
circular-dependencynpx madge --circular --extensions ts ./src
cleanrimraf lib
clean-overridesnode ./scripts/clean_overrides.js
create-release-branchchmod +x ./scripts/create_release_branch.sh && ./scripts/create_release_branch.sh
find-dead-codets-prune | grep -v '(used in module)'
find-unused-exportsts-unused-exports ./tsconfig.json
formatprettier --write --ignore-unknown "src/**/*" && pnpm lint
format-watch(git diff --name-only --diff-filter=ACM && git ls-files --others --exclude-standard) | grep -E '\.(ts|tsx)$' | xargs prettier --write
linteslint . --ext .js,.jsx,.ts,.tsx --max-warnings 0 --fix
lint-modified-fileschmod +x ./scripts/lint-modified-files.sh && ./scripts/lint-modified-files.sh
lint:fix-modified-fileschmod +x ./scripts/lint-modified-files.sh && LINT_FIX=true ./scripts/lint-modified-files.sh
only-buildeslint . --ext .js,.jsx,.ts,.tsx && time tsc && tsc -p tsconfig.esm.json && rimraf "lib/**/__mocks__" "lib/**/__testHelpers__"
only-build-deveslint . --ext .js,.jsx,.ts,.tsx && time tsc -p tsconfig.dev.json && tsc -p tsconfig.esm.dev.json && rimraf "lib/**/__mocks__" "lib/**/__testHelpers__"
postversiongit push && git push --tags
pr-approvals-updatechmod +x ./scripts/pr_approvals.sh && ./scripts/pr_approvals.sh
raise-pr-automationchmod +x ./scripts/raise_pr_automation.sh && ./scripts/raise_pr_automation.sh
send-release-noteschmod +x ./scripts/send_release_notes.sh && ./scripts/send_release_notes.sh
testpnpm lint-modified-files && pnpm test:typecheck-modified-files && pnpm test:typecheck-mocks-modified-files && vitest run --typecheck
test:filescripts/test-file.sh
test:fullpnpm test:typecheck-modified-files && pnpm test:typecheck-mocks-modified-files && vitest run --typecheck
test:typecheckecho 'Typechecking test files...' && NODE_OPTIONS=--max-old-space-size=4096 time tsc -p tsconfig.typecheck.json
test:typecheck-mocksecho 'Typechecking mock files...' && NODE_OPTIONS=--max-old-space-size=4096 time tsc -p tsconfig.mocks.json
test:typecheck-mocks-modified-fileschmod +x ./scripts/tsc-modified-files.sh && SINCE_DAYS=2 ./scripts/tsc-modified-files.sh master tsconfig.mocks.json
test:typecheck-modified-fileschmod +x ./scripts/tsc-modified-files.sh && SINCE_DAYS=2 ./scripts/tsc-modified-files.sh master tsconfig.typecheck.json
tsc-modified-fileschmod +x ./scripts/tsc-modified-files.sh && ./scripts/tsc-modified-files.sh
…and 3 more.

Dependencies15

@redux-devtools/extension^3.3.0
@reduxjs/toolkit^1.6.2
@stripe/stripe-js^4.4.0
big.js^7.0.1
cross-fetch^3.1.2
date-holidays^3.23.8
dayjs^1.10.7
dayjs-business-time^1.0.4
js-base64^3.6.0
lodash^4.18.1
pusher-js^8.4.0
redux^4.0.5
redux-observable^1.2.0
rxjs^6.6.6
url-parse^1.5.10