PkgRadar

Package evidence

[email protected]

Known Indicator Filename: package/admin/plugins/bundle.js

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,331Niche · −30% score
Versions published
335Mature · −50% score
First published
Jan 2015
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes10,168,368
Previous version9.2.1
Published2026-05-07T08:18:19.337Z
SHA-256e495aaacbf2279389750005e89d97bbf10a554de9e1a31cb0db98dcba2fd8863

Why flagged

What the scanner saw

Known Indicator Filename: package/admin/plugins/bundle.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
25Score
9.2.2Version
Status history (1 event)
  1. new → available · risk review · score 25 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highKnown Indicator Filenamepackage/admin/plugins/bundle.jspackage/admin/plugins/bundle.js45
mediumLarge Javascript Payloadpackage/admin/plugins/bundle.js2833590 bytes10
mediumLarge Javascript Payloadpackage/admin/vs/editor/editor.main.js2917518 bytes10
mediumLarge Javascript Payloadpackage/admin/custom/assets/index-C0RmLaAj.js3868930 bytes10
mediumLarge Javascript Payloadpackage/admin/vs/language/typescript/tsWorker.js4727185 bytes10

Manifest

Package metadata

Scripts29
  • //postinstallnode ./install/installTypings.js
  • 0-cleannode tasks.js --0-clean
  • 1-npmnode tasks.js --1-npm
  • 2-buildnode tasks.js --2-build
  • 3-copynode tasks.js --3-copy
  • 4-patchnode tasks.js --4-patch
  • admin-0-cleannode tasks.js --admin-0-clean
  • admin-1-npmnode tasks.js --admin-1-npm
  • admin-2-compilenode tasks.js --admin-2-compile
  • admin-3-copynode tasks.js --admin-3-copy
  • admin-buildnode tasks.js --admin-build
  • blocklyJson2wordsnode tasks.js --blocklyJson2words
  • blocklyWords2jsonnode tasks.js --blocklyWords2json
  • buildnpm run build-backend && node tasks
  • build-backendtsc -p tsconfig.build.json && node tasks --copy-types
  • build-editornode tasks.js --build
  • linteslint -c eslint.config.mjs
  • lint-alleslint -c eslint.config.mjs && cd src-editor && eslint -c eslint.config.mjs && cd ../src-admin && eslint -c eslint.config.mjs
  • monaco-typescriptnode tasks.js --monaco-typescript
  • monaco-updatenode tasks.js --monaco-update
  • npmnpm i && cd src-editor && npm i -f && cd ../src-admin && npm i
  • releaserelease-script --noPush -y --all
  • testnpm run test:declarations && npm run test:integration
  • test:declarationstsc -p test/lib/TS/tsconfig.json && tsc -p test/lib/JS/tsconfig.json
  • test:integrationmocha --exit
  • test:packagemocha test/testPackageFiles.js --exit
  • test:schedulermocha test/testScheduler.js --exit
  • translatetranslate-adapter
  • update-packagesnpx -y npm-check-updates --upgrade && cd src-editor && npx -y npm-check-updates --upgrade && cd ../src-admin && npx -y npm-check-updates --upgrade
Dependencies16
  • @iobroker/adapter-core^3.3.2
  • @iobroker/types^7.1.1
  • @types/node^25.6.0
  • axios^1.15.0
  • jsonata^2.1.0
  • jszip^3.10.1
  • node-inspect^2.0.0
  • node-schedule2.1.1
  • nodemailer^8.0.5
  • prettier^3.8.2
  • promisify-child-process^5.0.1
  • semver^7.7.4
  • suncalc2^1.8.1
  • typescript5.9.3
  • virtual-tsc^0.6.2
  • wake_on_lan^1.0.0