PkgRadar

Package evidence

geb==1.0.0b27

Py Custom Build Backend: Non-standard PEP 517 build-backend `uv_build` — runs custom code at install time.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
26Mature · −50% score
First published
Oct 2024
Publisher
Jens de Bruijn, Maurice Kalthof, Veerle Bril, Lars Tierolf, Tarun Sadana, Elisa Stefaniak, Tim Busker, Rafaella Oliveira, Carolina Carral, Roy Pontman, Lisanne van Amelsvoort, Joshua Kiesel

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["geb==1.0.0b27"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["geb==1.0.0b27"],"fail_on":"review"}'
PublisherJens de Bruijn, Maurice Kalthof, Veerle Bril, Lars Tierolf, Tarun Sadana, Elisa Stefaniak, Tim Busker, Rafaella Oliveira, Carolina Carral, Roy Pontman, Lisanne van Amelsvoort, Joshua Kiesel
Artifact bytes3,226,225
Previous versionnone
Published2026-06-03T13:21:58
SHA-256e4a9d848cdb89ca1c25704effff486672eb86b2ed43ba1d76ea013531b810a1f

Why flagged

What the scanner saw

Py Custom Build Backend: Non-standard PEP 517 build-backend `uv_build` — runs custom code at install time.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
7Score
1.0.0b27Version
Status history (1 event)
  1. new → available · risk review · score 7 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumPy Custom Build Backendpyproject.tomlNon-standard PEP 517 build-backend `uv_build` — runs custom code at install time.15