Package evidence

[email protected]

Large Javascript Payload: 39644493 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 11,241Mainstream · −50% score
Versions published: 980Mature · −50% score
First published: Dec 2014
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes16,740,155

Previous version51.0.0

Published2026-05-22T05:40:44.180Z

SHA-256659418a8c92880c92ca27ce5a7db6cf22466cc129d088a504968dff3b408b62c

Why flagged

What the scanner saw

Large Javascript Payload: 39644493 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

21d agoLast checked

reviewRisk

6Score

51.1.0Version

Status history (1 event)

new → available21d ago · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/browser/BitGoJS.min.js	39644493 bytes	10
medium	Large Javascript Payload	package/dist/test/v2/unit/internal/tssUtils/mocks/ecdsaNtilde.js	2864040 bytes	10

Manifest

Package metadata

Scripts22

auditif [ "$(npm --version | cut -d. -f1)" -ge "6" ]; then npm audit; else echo "npm >= 6 required to perform audit. skipping..."; fi
browser-testkarma start karma.conf.js
buildyarn tsc --build --incremental --verbose .
check-fmtprettier --check '**/*.{ts,js,json}'
cleanrm -r dist/*
compileyarn webpack-prod
compile-dbgyarn webpack-dev
compile-testyarn webpack-dev
coveragenyc -- npm run unit-test
fmtprettier --write '{src,test}/**/*.{ts,js,json}'
gen-docstypedoc
integration-testnyc -- mocha "test/v2/integration/**/*.ts"
linteslint --quiet .
preparenpm run build
prepublishOnlynpm run compile
testnpm run coverage
unit-testNODE_OPTIONS=--max-old-space-size=8192 mocha 'test/v2/unit/**/*.ts' 'test/unit/**/*.ts'
unprettiedgrep -R -L --include '*.ts' --include '*.js' --include '*.json' '@prettier' src test
upload-artifactsnode scripts/upload-test-reports.js
upload-docsnode scripts/upload-docs.js
webpack-devcross-env NODE_ENV=development webpack
webpack-prodNODE_OPTIONS=--max-old-space-size=4096 cross-env NODE_ENV=production webpack

Dependencies94

@bitgo/abstract-lightning^7.10.7
@bitgo/abstract-utxo^11.2.0
@bitgo/account-lib^27.22.0
@bitgo/sdk-api^1.80.1
@bitgo/sdk-coin-ada^4.24.5
@bitgo/sdk-coin-algo^2.10.9
@bitgo/sdk-coin-apechain^1.5.9
@bitgo/sdk-coin-apt^2.12.9
@bitgo/sdk-coin-arbeth^21.12.9
@bitgo/sdk-coin-asi^1.7.9
@bitgo/sdk-coin-atom^13.12.9
@bitgo/sdk-coin-avaxc^6.7.9
@bitgo/sdk-coin-avaxp^5.7.9
@bitgo/sdk-coin-baby^1.10.9
@bitgo/sdk-coin-bch^2.8.9
@bitgo/sdk-coin-bcha^2.9.9
@bitgo/sdk-coin-bera^2.8.9
@bitgo/sdk-coin-bld^3.7.9
@bitgo/sdk-coin-bsc^22.11.9
@bitgo/sdk-coin-bsv^2.8.9
@bitgo/sdk-coin-btc^2.13.9
@bitgo/sdk-coin-btg^2.8.9
@bitgo/sdk-coin-canton^1.21.0
@bitgo/sdk-coin-celo^6.3.9
@bitgo/sdk-coin-coredao^2.8.9
@bitgo/sdk-coin-coreum^21.9.9
@bitgo/sdk-coin-cosmos^1.9.9
@bitgo/sdk-coin-cronos^1.8.9
@bitgo/sdk-coin-cspr^2.6.9
@bitgo/sdk-coin-dash^2.8.9
…and 64 more.

Optional dependencies4

@ethereumjs/common^2.6.5
@ethereumjs/tx^3.3.0
ethereumjs-abi^0.6.5
ethereumjs-util7.1.5