Package evidence

[email protected]

Remote Dependency Spec: devDependencies.json-schema-test-suite="https://github.com/json-schema-org/JSON-Schema-Test-Suite#Test-JSON-Schema-Acceptance-1.037"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 395,352Ubiquitous · −70% score
Versions published: 128Mature · −50% score
First published: Nov 2016
Publisher: sagold

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishersagold

Artifact bytes603,408

Previous version11.4.0

Published2026-05-21T12:04:08.114Z

SHA-256c5cfb2763e4d0380f6a77c0a361c25decbadc80e9357b5b59fa42cda3b9f9c07

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.json-schema-test-suite="https://github.com/json-schema-org/JSON-Schema-Test-Suite#Test-JSON-Schema-Acceptance-1.037"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

9h agoLast checked

reviewRisk

2Score

11.4.1Version

Status history (1 event)

new → available9h ago · risk review · score 2 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.json-schema-test-suite="https://github.com/json-schema-org/JSON-Schema-Test-Suite#Test-JSON-Schema-Acceptance-1.037"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.json-schema-test-suite	https://github.com/json-schema-org/JSON-Schema-Test-Suite#Test-JSON-Schema-Acceptance-1.037	error	0	invalid gzip header

Manifest

Package metadata

Scripts24

coveragenyc npm run test --reporter=lcov
disttsdown -f esm -f cjs --minify --report --attw --unused; pnpm run dist:iife;
dist:iifetsdown --config tsdown.iife.config.ts --no-clean --minify --report; mv ./dist/jlib.iife.js ./dist/jlib.js
lintpnpm run lint:src && pnpm run lint:types
lint:srceslint src
lint:teststsc --noEmit --project tsconfig.test.json
lint:typestsc --noEmit
prepublishOnlypnpm run dist
tddwatch "npm run test:unit" src/
testmocha 'src/**/*.{test,spec}.ts'
test:2019mocha 'src/tests/spec/draft2019-09.spec.ts'
test:2019:ciDISABLE_LOG=true mocha -R json 'src/tests/spec/draft2019-09.spec.ts' > test-result-spec2019-09.json; exit 0
test:2020mocha 'src/tests/spec/draft2020-12.spec.ts'
test:2020:ciDISABLE_LOG=true mocha -R json 'src/tests/spec/draft2020-12.spec.ts' > test-result-spec2020-12.json; exit 0
test:4mocha 'src/tests/spec/draft04.spec.ts'
test:4:ciDISABLE_LOG=true mocha -R json 'src/tests/spec/draft04.spec.ts' > test-result-spec4.json; exit 0
test:6mocha 'src/tests/spec/draft06.spec.ts'
test:6:ciDISABLE_LOG=true mocha -R json 'src/tests/spec/draft06.spec.ts' > test-result-spec6.json; exit 0
test:7mocha 'src/tests/spec/draft07.spec.ts'
test:7:ciDISABLE_LOG=true mocha -R json 'src/tests/spec/draft07.spec.ts' > test-result-spec7.json; exit 0
test:inspectNODE_OPTIONS='--inspect-brk' mocha 'src/**/*.test.ts'
test:specmocha 'src/tests/spec/*.spec.ts'
test:unitmocha 'src/**/*.test.ts' 'bowtie/*.test.ts'
test:unit:ciDISABLE_LOG=true mocha -R json 'src/**/*.test.ts' -R json > test-result-unit.json; exit 0

Dependencies6

@hyperjump/json-schema-formats^1.0.1
@sagold/json-pointer^7.2.1
fast-copy^4.0.2
fast-deep-equal^3.1.3
uri-js^4.4.1
valid-url^1.0.9