PkgRadar

Package evidence

[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
2
First published
Jun 2026
Publisher
verlox

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherverlox
Artifact bytes1,943,801
Previous version0.1.0
Published2026-06-10T12:38:35.995Z
SHA-2560744b9126466cec23745da7c43807631a2fe6d3bfe7d67deadf5becd3c5c8de1

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
0.1.1Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts13
  • admintsx ../ops.carinaai.uk/server.ts
  • buildnode_modules/.bin/tsc && cp -r src/gateway/web dist/src/gateway/ && mkdir -p dist/src/security dist/src/web dist/src/skills/hub && cp src/security/injection-patterns.json dist/src/security/ && cp -r src/web/pricing dist/src/web/ && cp -r src/skills/hub/public dist/src/skills/hub/ && mkdir -p dist/public && cp -r public/dashboard dist/public/
  • carinatsx bin/carina.ts
  • clitsx src/index.ts
  • devtsx watch src/index.ts
  • docs:buildpnpm --dir ../docs.carinaai.uk build
  • docs:devpnpm --dir ../docs.carinaai.uk start
  • hubtsx src/skills/hub/server.ts
  • ingesttsx src/skills/ingestion.ts --pack property-uk
  • prepublishOnlypnpm build && pnpm test
  • startnode dist/src/index.js
  • testvitest run
  • test:watchvitest
Dependencies29
  • @anthropic-ai/sdk^0.100.1
  • @google/generative-ai^0.24.1
  • @inquirer/prompts^7.10.1
  • @slack/bolt^4.6.0
  • @whiskeysockets/baileys7.0.0-rc13
  • bcryptjs^2.4.3
  • better-sqlite3^11.10.0
  • chalk^5.6.2
  • croner^10.0.1
  • discord.js^14.19.3
  • dotenv^17.4.2
  • ejs^3.1.10
  • express^5.2.1
  • express-rate-limit^8.5.2
  • express-session^1.18.0
  • ioredis^5.11.0
  • node-telegram-bot-api^0.67.0
  • openai^6.41.0
  • pg^8.21.0
  • pgvector^0.3.0
  • playwright^1.60.0
  • readline-sync^1.4.10
  • resend^6.12.4
  • stripe^20.4.0
  • tsx^4.22.4
  • twilio^5.12.2
  • uuid^14.0.0
  • yaml^2.8.1
  • zod^4.4.3