PkgRadar

Package evidence

[email protected]

Remote Payload: matched "api.github.com/graphql"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1
First published
Jun 2026
Publisher
stonecypher

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherstonecypher
Artifact bytes16,584,274
Previous versionnone
Published2026-06-03T13:57:11.767Z
SHA-256d1239839c27f03656a9afcc02487fe76e8f73f25a0a8b80716354ff9410bf5fb

Why flagged

What the scanner saw

Remote Payload: matched "api.github.com/graphql"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
50Score
0.15.0Version
Status history (1 event)
  1. new → available · risk review · score 50 · status changed

Evidence

Static findings

14 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
Show all 14 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/index.cjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/index.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/dist/issue-tree.mjsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a5e981f74c07557f9/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
mediumRemote Payloadpackage/src/ts/scanner/github-client.tsmatched "api.github.com/graphql"12
lowObfuscation Densitypackage/.claude/worktrees/agent-a5e981f74c07557f9/package-lock.jsonhigh encoded/escaped-token density0
lowObfuscation Densitypackage/.claude/worktrees/agent-a8ff684e7cc5dbb0f/package-lock.jsonhigh encoded/escaped-token density0

Manifest

Package metadata

Scripts22
  • attwattw --pack .
  • buildnpm run clean && npm run just_test_save && npm run typescript && npm run docs && npm run update_madlibs && npm run eslint && npm run rollup && npm run viz_png && npm run docs && npm run terser && npm run dts && npm run rollup-cts && npm run attw && npm run cloc && npm run site && npm run changelog
  • changelogrm -f CHANGELOG.md && rm -f CHANGELOG.long.md && rm -f ./src/doc_md/CHANGELOG.md && rm -f ./src/doc_md/CHANGELOG.long.md && better_git_changelog -b && cp CHANGELOG.* ./src/doc_md/
  • ciecho starting && node -e "console.log(new Date().toLocaleString())" && npm run build && echo finishing && node -e "console.log(new Date().toLocaleString())"
  • cleancd src && cd ts && rimraf generated_code && mkdir generated_code && cd .. && cd .. && rimraf build && mkdir build && cd build && mkdir rollup && cd rollup && mkdir visualizations && cd .. && cd .. && rimraf dist && mkdir dist && rimraf docs && mkdir docs && cd docs && mkdir dist && mkdir docs && cd .. && rimraf coverage-typedoc && mkdir coverage-typedoc && rm -f bundle_sunburst.png bundle_treemap.png bundle_network.png bundle_flamegraph.png
  • cloccloc --quiet ./src/** --exclude-list-file=./.clocignore --3 --json --out=./coverage/cloc/report_wt.json && cloc --quiet ./src/** --exclude-list-file=./.clocignore --exclude-dir=tests --3 --json --out=./coverage/cloc/report_nt.json && node ./src/build_js/cloc_report.cjs
  • dev:install_playwrightnpx playwright install --with-deps
  • docstypedoc src/ts/index.ts --options typedoc-options.cjs --out docs/docs
  • dtsrollup -c rollup.dtsphase.config.js
  • eslinteslint
  • just_testvitest run --coverage && vitest run --config vitest-stoch.config.ts --coverage && vitest run --config vitest-stoch.mutat.ts --coverage
  • just_test_savenode src/build_js/run_tests_save.js
  • rolluprollup -c
  • rollup-ctsrollup -c rollup.ctsphase.config.js
  • sitecp src/html/* docs && cp src/html/.nojekyll docs && cp README.md docs/ && cp dist/index.mjs docs/docs/ && cp src/html/*.png docs/docs
  • strykernpx stryker run
  • terserterser -o dist/index.mjs --source-map "content='build/rollup/index.mjs.map',url='index.mjs.map'" build/rollup/index.mjs && terser -o dist/index.cjs --source-map "content='build/rollup/index.cjs.map',url='index.cjs.map'" build/rollup/index.cjs && terser -o dist/issue-tree.mjs build/rollup/issue-tree.mjs && cp build/rollup/issue-tree-client.js dist/issue-tree-client.js
  • testnpm run build
  • typescripttsc --build tsconfig.json
  • update_madlibsnode src/build_js/update_madlibs.js && cp README.md docs
  • verifynpm run clean && npm run just_test_save && npm run typescript && npm run rollup && npm run terser && npm run dts && npm run rollup-cts
  • viz_pngnode src/build_js/html_to_png.js --url build/rollup/visualizations/bundle_sunburst.html --width 768 --height 480 --out build/rollup/visualizations/bundle_sunburst.png && node src/build_js/html_to_png.js --url build/rollup/visualizations/bundle_treemap.html --width 768 --height 480 --out build/rollup/visualizations/bundle_treemap.png && node src/build_js/html_to_png.js --url build/rollup/visualizations/bundle_network.html --width 768 --height 480 --out build/rollup/visualizations/bundle_network.png && node src/build_js/html_to_png.js --url build/rollup/visualizations/bundle_flamegraph.html --width 768 --height 480 --out build/rollup/visualizations/bundle_flamegraph.png && cp build/rollup/visualizations/bundle_*.png . && cp build/rollup/visualizations/bundle_*.png docs/ && cp build/rollup/visualizations/bundle_*.png docs/docs/
Dependencies3
  • @resvg/resvg-js^2.6.2
  • @viz-js/viz^3.27.0
  • jpeg-js^0.4.4