Package evidence

[email protected]

Large Javascript Payload: 14730427 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 4,450Niche · −30% score
Versions published: 120
First published: Apr 2026
Publisher: calm2026

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishercalm2026

Artifact bytes21,921,370

Previous version8.13.9

Published2026-05-22T03:32:54.272Z

SHA-256ea00289e96a3deb373cf8b5e9124632e3a1176128b6f0cb354a5aa1c4aae6e57

Why flagged

What the scanner saw

Large Javascript Payload: 14730427 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

14d agoLast checked

lowRisk

0Score

8.13.10Version

Status history (5 events)

available → available14d ago · risk low · score 0 · status available -> available, risk high -> low, score 112 -> 0
available → available19d ago · risk high · score 112 · status available -> available, risk high -> high, score 119 -> 112
available → available19d ago · risk high · score 119 · status available -> available, risk high -> high, score 170 -> 119
available → available19d ago · risk high · score 170 · status available -> available, risk high -> high, score 701 -> 170
new → available20d ago · risk high · score 701 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

calm2026

6 members · evidence strength 84

Repeated static TTPstale

Credential file access — matched ".Aws"

50 members · evidence strength 90

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/dist/cli.js	14730427 bytes	0
low	Large Javascript Payload	package/dist/openai-responses-adapter.js	2245609 bytes	0

Manifest

Package metadata

Scripts45

autoresearch:memorynode scripts/run-memory-autoresearch-eval.mjs
autoresearch:platformnode scripts/run-platform-autoresearch.mjs
buildnpm run verify:dist-clean && npm run check && npm pack --dry-run
build:knowledgenode scripts/build-project-knowledge.mjs
campaign:contextnode scripts/run-campaign-round.mjs --campaign context-engine
campaign:intentnode scripts/run-campaign-round.mjs --campaign intent-engine
campaign:memorynode scripts/run-campaign-round.mjs --campaign memory-engine
campaign:world-classnode scripts/run-campaign-round.mjs --campaign world-class-core
checknpm run vendor:ripgrep && npm run validate:repo && npm run verify:dist && npm run verify:source-build && npm run check:source-purity && npm test
check:boundariesnode scripts/check-architecture-boundaries.mjs
check:eval-baselinenode scripts/check-world-class-eval-baseline.mjs
check:hygienenpm run validate:repo
check:knipnode scripts/check-knip-baseline.mjs
check:provider-matrixnode scripts/check-provider-matrix.mjs
check:runtimenpm run verify:provider:smoke && npm run test:route-policy && npm run test:workflow-continuity && npm run test:coding-regression
check:source-puritynode scripts/check-source-purity.mjs
content:allnpm run content:release-notes && npm run content:llms-txt && npm run content:robots
content:llms-txtnode scripts/content-gen/generate-llms-txt.mjs
content:release-notesnode scripts/content-gen/generate-release-notes.mjs
content:robotsnode scripts/content-gen/generate-robots.mjs
debug:route-policynode scripts/debug-route-policy.mjs
eval:world-classnode scripts/run-world-class-evals.mjs
package:releasenpm run verify:dist-clean && npm run check && node scripts/package-release.mjs
provider:matrixnode scripts/run-provider-matrix.mjs
rebuild:distCLAVUE_BUILD_TARGET=dist node scripts/build-plugin.mjs
rebuild:experimentalnpm run verify:source-build
rebuild:experimental:legacynode scripts/build.mjs
release:preflightnode scripts/release-preflight.mjs
release:reportnode scripts/generate-release-report.mjs --append-ledger
restore:authored-sourcenode scripts/restore-authored-source.mjs
…and 15 more.

Dependencies13

@anthropic-ai/sandbox-runtime^0.0.49
@openai/codex0.118.0
@opentelemetry/api^1.9.1
@opentelemetry/api-logs^0.214.0
@opentelemetry/core^2.6.1
@opentelemetry/resources^2.6.1
@opentelemetry/sdk-logs^0.214.0
@opentelemetry/sdk-metrics^2.6.1
@opentelemetry/sdk-trace-base^2.6.1
@opentelemetry/semantic-conventions^1.40.0
ajv^8.18.0
lru-cache^11.3.0
qrcode^1.5.4