Package evidence

[email protected]

Large Javascript Payload: 15138437 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 5,908Niche · −30% score
Versions published: 185
First published: Apr 2026
Publisher: calm2026

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishercalm2026

Artifact bytes21,030,346

Previous version8.28.6

Published2026-06-13T06:35:13.096Z

SHA-256c99064272c1e17f1a6230b6f7cec70ddff5dd7f44005b811c95c1b17b50dc605

Why flagged

What the scanner saw

Large Javascript Payload: 15138437 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

11h agoLast checked

lowRisk

0Score

8.28.7Version

Status history (1 event)

new → available11h ago · risk low · score 0 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/dist/cli.js	15138437 bytes	0
low	Large Javascript Payload	package/dist/openai-responses-adapter.js	2327842 bytes	0

Manifest

Package metadata

Scripts55

autoresearch:memorynode scripts/run-memory-autoresearch-eval.mjs
autoresearch:platformnode scripts/run-platform-autoresearch.mjs
benchmark:gpt5-responsesnode scripts/benchmark-gpt5-responses.mjs
benchmark:startupnode scripts/benchmark-startup.mjs
buildnpm run check:release && npm pack --dry-run
build:knowledgenode scripts/build-project-knowledge.mjs
campaign:contextnode scripts/run-campaign-round.mjs --campaign context-engine
campaign:intentnode scripts/run-campaign-round.mjs --campaign intent-engine
campaign:memorynode scripts/run-campaign-round.mjs --campaign memory-engine
campaign:world-classnode scripts/run-campaign-round.mjs --campaign world-class-core
checknpm run check:quick
check:boundariesnode scripts/check-architecture-boundaries.mjs
check:eval-baselinenode scripts/check-world-class-eval-baseline.mjs
check:hygienenpm run validate:repo
check:knipnode scripts/check-knip-baseline.mjs
check:provider-matrixnode --no-warnings --loader ./tests/ts-esm-loader.mjs scripts/check-provider-matrix.mjs
check:quicknpm run validate:repo && npm run check:source-purity && npm run check:boundaries && npm test
check:releasenpm run vendor:ripgrep && npm run validate:repo && npm run verify:dist-clean && npm run verify:dist && npm run verify:source-build && npm run check:source-purity && npm run check:boundaries && npm test
check:runtimenpm run verify:provider:smoke && npm run test:route-policy && npm run test:workflow-continuity && npm run test:coding-regression
check:source-puritynode scripts/check-source-purity.mjs
clean:buildsnode scripts/build-plugin.mjs --clean
content:allnpm run content:release-notes && npm run content:llms-txt && npm run content:robots
content:llms-txtnode scripts/content-gen/generate-llms-txt.mjs
content:release-notesnode scripts/content-gen/generate-release-notes.mjs
content:robotsnode scripts/content-gen/generate-robots.mjs
debug:route-policynode --no-warnings --loader ./tests/ts-esm-loader.mjs scripts/debug-route-policy.mjs
dev:expnode experimental-dist/cli.js
eval:allnode scripts/run-memory-recall-eval.mjs && node scripts/aggregate-tacit-signals.mjs
eval:memory-recallnode scripts/run-memory-recall-eval.mjs
eval:tacit-intentnode scripts/aggregate-tacit-signals.mjs
…and 25 more.

Dependencies13

@anthropic-ai/sandbox-runtime^0.0.49
@openai/codex0.118.0
@opentelemetry/api^1.9.1
@opentelemetry/api-logs^0.214.0
@opentelemetry/core^2.6.1
@opentelemetry/resources^2.6.1
@opentelemetry/sdk-logs^0.214.0
@opentelemetry/sdk-metrics^2.6.1
@opentelemetry/sdk-trace-base^2.6.1
@opentelemetry/semantic-conventions^1.40.0
ajv^8.18.0
lru-cache^11.3.0
qrcode^1.5.4