Package evidence

[email protected]

Remote Dependency Spec: devDependencies.js-utils="https://github.com/danieloakman/js-utils/releases/download/v0.16.2/package.tgz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,458Niche · −30% score
Versions published: 114Mature · −50% score
First published: Jun 2022
Publisher: danoaky

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherdanoaky

Artifact bytes124,854

Previous version4.1.5

Published2025-02-10T06:01:06.964Z

SHA-2563e95a0fa44041b162f32351c8cc936c6cb45622deac4b146f76f6964ac8f7562

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.js-utils="https://github.com/danieloakman/js-utils/releases/download/v0.16.2/package.tgz"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17d agoLast checked

reviewRisk

4Score

4.1.6Version

Status history (1 event)

new → available17d ago · risk review · score 4 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	devDependencies.js-utils="https://github.com/danieloakman/js-utils/releases/download/v0.16.2/package.tgz"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.js-utils	https://github.com/danieloakman/js-utils/releases/download/v0.16.2/package.tgz	error	0	unexpected end of file

Manifest

Package metadata

Scripts25

asyncifyts-node ./scripts/asyncify.ts
asyncify:cleants-node ./scripts/asyncify.ts -c
asyncify:watchts-node ./scripts/asyncify.ts -w
bmts-node src/benchmark/index.bm.ts
bm:profnode -r ts-node/register --prof src/benchmark/index.bm.ts
buildconcurrently "tsc -p tsconfig.json" "tsc -p tsconfig.es5.json" "tsc -p tsconfig.esm.json" "tsc -p tsconfig.types.json"
checktsc -p tsconfig.test.json
check:watchpnpm run check --watch
cleanrimraf dist iteragain*.tgz
coveragenyc ts-mocha src/test/**.test.ts
docs:buildtypedoc --plugin typedoc-plugin-remove-references --includeVersion --entryPointStrategy expand src/
docs:deploypnpm run docs:build && pnpm gh-pages -d docs --nojekyll -u "Daniel Oakman <[email protected]>"
formatprettier --write **.ts
linteslint src
new:functionts-node ./scripts/new-function.ts
new:iteratorts-node ./scripts/new-iterator.ts
new:testts-node ./scripts/new-test.ts
postversiongit push --follow-tags
preparehusky
preversionpnpm check && pnpm lint && pnpm coverage
testts-mocha src/**/*.test.ts --reporter spec
test:debugpnpm run test --inspect
v:majorpnpm version major -f -m "Upgrade package version to v%s"
v:minorpnpm version minor -f -m "Upgrade package version to v%s"
v:patchpnpm version patch -f -m "Upgrade package version to v%s"