Package evidence

[email protected]

Install-time lifecycle script: postinstall="npm run build && npm run buildTokenList"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 18,708Mainstream · −50% score
Versions published: 183Mature · −50% score
First published: Nov 2018
Publisher: asmiller1989

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherasmiller1989

Artifact bytes378,066

Previous version0.0.2-dev2-unstable

Published2018-11-14T20:27:28.621Z

SHA-256a099976ccc8c9a3cce9638bcbd6639152c36e45e806fedefe7e476ffbcd40482

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="npm run build && npm run buildTokenList"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20h agoLast checked

reviewRisk

1Score

0.0.2-developmentVersion

Status history (1 event)

new → available20h ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="npm run build && npm run buildTokenList"	5

Manifest

Package metadata

Scripts24

buildrm -rf dist/* && babel src -d dist
build:prodNODE_ENV=production rm -rf dist/* && babel src -d dist
build:watchbabel src -d dist -w
buildTokenListnode support/getTokenList.js
commitgit-cz
linteslint src test __tests__
lint:fixeslint --fix src test __tests__
postinstallnpm run build && npm run buildTokenList
precommitnpm run lint:fix && npm run test
prepublishnpm run build
semantic-releasesemantic-release
sendBTCnode --require babel-core/register support/scripts/sendBTC.js
sendETHnode --require babel-core/register support/scripts/sendETH.js
sleepsleep 20
testmocha --timeout 5000 -R spec --require babel-core/register test/local-*.js --recursive --exit
test-dockernpm run sleep && npm run test test:integration
test:bcymocha --timeout 100000 -R spec --require babel-core/register test/btc-bcy.js --recursive --exit
test:integrationNODE_ENV=test jest --config jest.integration.json --coverage --verbose
test:integration:watchNODE_ENV=test jest --config jest.integration.json --watch --coverage --verbose
test:jestNODE_ENV=test jest --config jest.json --verbose
test:rinkebymocha --timeout 60000 -R spec --require babel-core/register test/eth-rinkeby.js --recursive --exit
test:testnet3mocha --timeout 60000 -R spec --require babel-core/register test/btc-testnet3.js --recursive --exit
test:watchmocha -R spec --require babel-core/register test --recursive --watch
test:watch:jestNODE_ENV=test jest --config jest.json --watch --coverage --verbose

Dependencies15

aes-js^3.1.1
bignumber.js^8.0.1
bitcoinjs-lib^4.0.1
bn.js^4.11.8
buffer^5.1.0
debug^4.1.0
eccrypto^1.0.3
elliptic^6.4.0
ethersGridPlus/ethers.js#master
gridplus-bclient^0.1.2
left-pad^1.3.0
mocha^5.2.0
semantic-release-cli^4.0.9
sjcl^1.0.7
superagent^3.8.3