PkgRadar

Package evidence

[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
532Mature · −50% score
First published
Apr 2014
Publisher
piascikj

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherpiascikj
Artifact bytes141,061
Previous version2.1.11
Published2026-06-01T21:33:00.663Z
SHA-256cc6d660498c693817f8e4b3c16c163543b059ffb1e3dda2a4781b5093d1ac54b

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
7Score
2.2.0Version
Status history (1 event)
  1. new → available · risk review · score 7 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/lib/plugins/plugin-registry.jsmatched "raw.githubusercontent.com"12
mediumRemote Dependency Specpackage.jsondependencies.monquery="github:imdone/node-monquery#0.2.2"12
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/lib/plugins/plugin-registry.jsmatched "raw.githubusercontent.com"12
mediumRemote Dependency Specpackage.jsondependencies.monquery="github:imdone/node-monquery#0.2.2"12
lowObfuscation Densitypackage/lib/task.jshigh encoded/escaped-token density0

Manifest

Package metadata

Scripts13
  • buildnpm run pre-commit && npm run coverage
  • build:docsdoctoc --github --notitle README.md
  • build:docs:indexnode scripts/index-markdown.js
  • build:indexnode scripts/generate-index.js
  • build:typestsc --noEmit false
  • coveragevitest --run --coverage
  • linknpm link ../imdone-api
  • pre-commitnpm run build:docs && npm run build:docs:index && npm run build:index && npm run build:types
  • preparehusky
  • prepublishOnlynpm run build
  • servenpx docsify-cli serve
  • testnpm run coverage
  • test-civitest --run
Dependencies54
  • adm-zip^0.5.16
  • async^3.2.6
  • async-es^3.2.6
  • chalk^5.4.1
  • chokidar^4.0.3
  • chrono-node~2.7.8
  • commander^13.1.0
  • debug>=4.3.4
  • eol^0.9.1
  • escape-string-regexp^1.0.5
  • eta^3.5.0
  • fast-sort^3.4.1
  • find-up-simple^1.0.1
  • gray-matter^4.0.2
  • ignore^5.2.0
  • imdone-api^2.0.4
  • isbinaryfile^5.0.4
  • js-yaml^3.14.1
  • json-fns^1.0.0
  • lodash.assign^4.2.0
  • lodash.debounce^4.0.8
  • lodash.groupby^4.6.0
  • lodash.isempty^4.4.0
  • lodash.isfunction^3.0.9
  • lodash.isnumber^3.0.3
  • lodash.isobject^3.0.2
  • lodash.isstring^4.0.1
  • lodash.isundefined^3.0.1
  • lodash.noop^3.0.1
  • lodash.reject^4.6.0
  • …and 24 more.