Package evidence

[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishermrbond007

Artifact bytes1,996,578

Previous versionnone

Published2026-05-23T06:57:53.451Z

SHA-2565a0703f1073b21da1f7d7ac61e3cea4925b9213ee6dce528bf606386403ce1c3

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

28Score

0.2.0Version

Status history (1 event)

new → available20d ago · risk review · score 28 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/io-package.json	matched "raw.githubusercontent.com"	12
medium	Large Javascript Payload	package/admin/custom/assets/_virtual_mf___mfe_internal__ConfigCustomAiEnergyManager__loadShare___mf_0_iobroker_mf_1_adapter_mf_2_react_mf_2_v5__loadShare__.mjs-Qmea7kmD.js	9720074 bytes	10

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/io-package.json	matched "raw.githubusercontent.com"	12
medium	Large Javascript Payload	package/admin/custom/assets/_virtual_mf___mfe_internal__ConfigCustomAiEnergyManager__loadShare___mf_0_iobroker_mf_1_adapter_mf_2_react_mf_2_v5__loadShare__.mjs-Qmea7kmD.js	9720074 bytes	10
low	Obfuscation	package/admin/custom/assets/_virtual_mf___mfe_internal__ConfigCustomAiEnergyManager__loadShare___mf_0_emotion_mf_1_react__loadShare__.mjs-C_QoYoiQ.js	matched "fromCharCode"	3
low	Obfuscation	package/admin/custom/assets/main-B8zKNpy9.js	matched "\\u0048"	3

Manifest

Package metadata

Scripts11

build:adminvite build --config src-admin/vite.config.js && node scripts/update-admin-cache-bust.js && prettier admin/custom --write && prettier admin/jsonConfig.json5 --write && prettier admin/custom --write
checknode --check main.js && node --check lib/*.js && node --check test/*.js
formatprettier . --write
format:checkprettier . --check
linteslint -c eslint.config.mjs .
lint:fixeslint -c eslint.config.mjs . --fix
prepublishOnlynpm run build:admin && npm run check && npm run lint && npm test
releaserelease-script
testnode --test
test:integrationnpm test
test:packagenpm test

Dependencies1

@iobroker/adapter-core^3.3.2