PkgRadar

Package evidence

[email protected]

Suspicious Publish Context: {"package_age_days":0,"publisher":"mfittko","burst_same_day":0,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1
First published
Jun 2026
Publisher
mfittko

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishermfittko
Artifact bytes362,963
Previous versionnone
Published2026-06-15T22:41:16.099Z
SHA-25670eb8144d2dff5e89d7f8f21869e63038e8e956cd1a2977dbb9ebe923621c2d5

Why flagged

What the scanner saw

Suspicious Publish Context: {"package_age_days":0,"publisher":"mfittko","burst_same_day":0,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
10Score
0.1.0Version
Status history (1 event)
  1. new → available · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumSuspicious Publish Contextmanifest{"package_age_days":0,"publisher":"mfittko","burst_same_day":0,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}10

Manifest

Package metadata

Scripts26
  • repo-wikinode scripts/repo-wiki.mjs
  • repo-wiki:bootstrapnode scripts/repo-wiki.mjs scan --repo . && node scripts/repo-wiki.mjs plan --repo . && node scripts/repo-wiki.mjs compile --repo .
  • repo-wiki:compilenode scripts/repo-wiki.mjs compile --repo .
  • repo-wiki:initnode scripts/repo-wiki.mjs init --repo .
  • repo-wiki:lintnode scripts/repo-wiki.mjs lint --repo .
  • repo-wiki:lint-docsnode scripts/repo-wiki.mjs lint-docs --repo .
  • repo-wiki:localnode scripts/repo-wiki-local.mjs
  • repo-wiki:local-bootstrapnode scripts/repo-wiki-local.mjs scan --repo . && node scripts/repo-wiki-local.mjs plan --repo . && node scripts/repo-wiki-local.mjs compile --repo .
  • repo-wiki:local-compilenode scripts/repo-wiki-local.mjs compile --repo .
  • repo-wiki:local-lintnode scripts/repo-wiki-local.mjs lint --repo .
  • repo-wiki:local-lint-docsnode scripts/repo-wiki-local.mjs lint-docs --repo .
  • repo-wiki:local-plannode scripts/repo-wiki-local.mjs plan --repo .
  • repo-wiki:local-scannode scripts/repo-wiki-local.mjs scan --repo .
  • repo-wiki:plannode scripts/repo-wiki.mjs plan --repo .
  • repo-wiki:preparenode scripts/repo-wiki-local.mjs prepare
  • repo-wiki:scannode scripts/repo-wiki.mjs scan --repo .
  • repo-wiki:searchnode scripts/repo-wiki.mjs search --repo .
  • testnpm run test:assets && npm run test:extension && npm run test:scripts && npm run test:core && npm run test:docs
  • test:assetsnode --test --test-reporter ./test/failure-summary-reporter.mjs test/dev-loop-init-phase-smoke.test.mjs test/contracts/*.test.mjs test/workflow-handoff-contract.test.mjs
  • test:corenode --test --test-reporter ./test/failure-summary-reporter.mjs packages/core/test/*.test.mjs
  • test:dev-loopnode --test --test-reporter ./test/failure-summary-reporter.mjs skills/dev-loop/scripts/dev-mode-context.test.mjs skills/dev-loop/scripts/render-template.test.mjs skills/dev-loop/scripts/post-gate-verdict-fallback.test.mjs
  • test:docsnode scripts/docs/validate-links.mjs && node scripts/docs/validate-no-duplicate-rules.mjs
  • test:extensionnode --import tsx --test --test-reporter ./test/failure-summary-reporter.mjs test/extension-checks.test.mjs test/extension-post-merge-update.test.mjs test/extension-command-contract.test.mjs test/extension-package-contract.test.mjs test/dev-loops-core.test.mjs test/dev-loops-cli.test.mjs
  • test:playwright:viewerplaywright test -c playwright.inspect-run-viewer.config.mjs
  • test:scriptsnode --test --test-reporter ./test/failure-summary-reporter.mjs test/github/*.test.mjs test/loop/*.test.mjs test/docs/*.test.mjs test/projects/*.test.mjs
  • verifynpm test && npm run test:dev-loop
Dependencies3
  • @dev-loops/core^0.1.0
  • mermaid11.15.0
  • zod^4.4.3