Package evidence

[email protected]

Large Javascript Payload: 4024017 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 37Mature · −50% score
First published: Mar 2019
Publisher: williambelle

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherwilliambelle

Artifact bytes30,214,425

Previous version5.7.1

Published2026-05-26T11:30:45.831Z

SHA-2561a0b81eb501ccde73d1ddb3d6977f53c4aff708568ca54d74e9c5b2355dbd8ac

Why flagged

What the scanner saw

Large Javascript Payload: 4024017 bytes

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

22d agoLast checked

reviewRisk

14Score

5.7.2Version

Status history (1 event)

new → available22d ago · risk review · score 14 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/js/reader.js	4024017 bytes	10
medium	Large Javascript Payload	package/dist/js/reader.min.js	2668552 bytes	10
high	Remote Dependency Spec	package.json	devDependencies.colorable="https://github.com/epfl-si/colorable"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.colorable	https://github.com/epfl-si/colorable	error	0	invalid gzip header

Manifest

Package metadata

Scripts14

buildyarn dist
cleanrm -rf build/ dist/
distwebpack --mode=production
linteslint .
realcleanrm -rf build/ dist/ node_modules/
releaserelease-it
startwebpack --mode=development --watch
stylelintstylelint '**/*.scss'
test:approvebackstop approve --config=build/backstop.json
test:changesbash -c ' backstop test --config=build/backstop.json "$@" ' --
test:infonode scripts/backstop_status.js
test:preparebash -c ' set -e -x; install -d build; node scripts/make_backstop_json.js "$@" ' --
test:referencebackstop reference --config=build/backstop.json
test:reportbackstop openReport --config=build/backstop.json

Dependencies16

@selectize/selectize^0.13.6
bootstrap^4.6.2
clipboard^2.0.11
cookieconsent^3.1.1
feather-icons^4.29.0
flickity2.2.2
flickity-as-nav-for^2.0.1
flickity-fullscreen^1.1.1
imagesloaded^4.1.4
intro.js^2.9.3
jquery^3.7.1
jquery-mousewheel^3.1.13
multiple-select^2.2.0
pickadate^3.6.4
popper.js^1.16.1
tablesaw^3.1.2