PkgRadar

Package evidence

[email protected]

Remote Dependency Spec: dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
154
Versions published
8
First published
May 2026
Publisher
andriishylenko

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherandriishylenko
Artifact bytes8,852,836
Previous version0.6.1
Published2026-05-23T14:55:50.191Z
SHA-256517a6dd0f868e62f8ae61e01751e9136e8ef6a6f93c906fda37a59365ea63329

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
12Score
0.11.0Version
Status history (1 event)
  1. new → available · risk review · score 12 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"12
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"12
lowLarge Javascript Payloadpackage/dist/cli/index.js13359173 bytes0

Manifest

Package metadata

Scripts45
  • buildtsc -b && vite build
  • build:clitsc --noEmit -p tsconfig.cli.json && node scripts/build-cli.mjs
  • capture-demonpx tsx scripts/captureDemo.ts
  • capture-demo:donutnpx tsx scripts/captureDemo.ts --script examples/v0.21/donut.kcad.ts --prompt scripts/demo-prompts/v0.21-donut.md --module v0.21 --output docs/demos/v0.21/donut/ --hero-artifact donut
  • capture-demo:heronpx tsx scripts/captureDemo.ts --task bracket-holes --module v0.21 --output docs/demos/v0.21/bracket-holes/ --hero-artifact bracket-holes --override-approved-by 'pre-Task-10: bracket-holes scheduled for replacement by donut'
  • capture-demo:retro-v0.1npx tsx scripts/captureDemo.ts --script examples/bracket-with-hole.kcad.ts --prompt scripts/demo-prompts/v0.1-bracket.md --module v0.1 --output docs/demos/v0.1/bracket-with-hole/ --hero-artifact bracket-with-hole --override-approved-by 'grandfathered: pre-policy v0.1 retro capture'
  • capture-demo:retro-v0.2npx tsx scripts/captureDemo.ts --task subtract-then-fillet-rim --module v0.2 --output docs/demos/v0.2/subtract-then-fillet-rim/ --hero-artifact subtract-then-fillet-rim --override-approved-by 'grandfathered: pre-policy v0.2 retro capture'
  • capture-demo:v0.6-heronpx tsx scripts/captureDemo.ts --script examples/robot-arm/desktop-3axis-mates.kcad.ts --prompt scripts/demo-prompts/v0.6.0-desktop-3axis-mates.md --module v0.6 --output docs/demos/v0.6/desktop-3axis-mates/ --hero-artifact desktop-3axis-mates
  • capture-demo:v0.7.1-patternsnpx tsx scripts/captureDemo.ts --script eval/tasks/grid-heat-sink-fin-array/solution-expert.kcad.ts --prompt scripts/demo-prompts/v0.7.1-grid-heat-sink-fin-array.md --module v0.7.1 --output docs/demos/v0.7.1/grid-heat-sink-fin-array/ --hero-artifact grid-heat-sink-fin-array
  • cookbook:buildnpx tsx scripts/buildCookbookIndex.ts
  • cookbook:evaluatenpx tsx scripts/cookbookEvaluate.ts
  • cookbook:validatenpx tsx scripts/cookbookValidate.ts
  • devvite
  • evalnpx tsx eval/run.ts
  • eval:abnpx tsx scripts/evalAb.ts
  • linteslint .
  • lint-demosnpx tsx scripts/lint-demos.ts
  • portfolio:attemptnpx tsx scripts/portfolioAttempt.ts
  • portfolio:capturenpx tsx scripts/capturePortfolioEntry.ts
  • portfolio:validatenpm test -- tests/integration/portfolio/portfolioBundle.test.ts tests/unit/portfolio/portfolioMeta.test.ts
  • prebuildtsr generate
  • prepacknpm run build:cli
  • pretypechecktsr generate
  • previewvite preview
  • proof:assembly-contractnpm run proof:foundation && npm test -- tests/unit/assemblies/assemblyCapture.test.ts tests/unit/backends/occt/assemblyLowerer.test.ts tests/integration/examples/assemblyExamples.test.ts tests/unit/skill/skillGlobalsDrift.test.ts
  • proof:foundationnpm run typecheck && npm run test:audit && npm run test:hygiene && npm run test:package && npm test -- src/modeling/constraints/solver.test.ts src/modeling/constraints/advanced_constraints.test.ts tests/integration/diagnostics/hint-mandatory.test.ts tests/integration/diagnostics/next-action-mandatory.test.ts scripts/lib/whatsNewTemplate.test.ts tests/integration/mcp/listApi.driftSentinel.test.ts tests/unit/skill/skillShapeMethodsDrift.test.ts tests/unit/patterns/patternCapture.test.ts tests/unit/backends/occt/patternLowerer.test.ts tests/integration/examples/patternExamples.test.ts
  • proof:matesnpm run proof:assembly-contract && npm test -- src/modeling/mates/ src/shared/numeric/ tests/unit/assemblies/solvedModelValidate.test.ts tests/unit/assemblies/solvedModelGroundingGates.test.ts tests/integration/examples/desktop3axisMates.test.ts tests/integration/mcp/addConnector.test.ts tests/integration/mcp/addMate.test.ts tests/integration/mcp/listMates.test.ts tests/integration/mcp/validateAssembly.test.ts tests/integration/mcp/solveMates.test.ts tests/unit/cli/evaluateValidateGate.test.ts
  • qcnpm run qc:lint && npm run qc:build && npm run qc:test
  • qc:buildnpm run typecheck && npm run build:cli && npm run cookbook:build && git diff --exit-code src/agent/skills && npm run cookbook:evaluate
  • qc:fullnpm run qc && npm run test:e2e && npm run build
  • …and 15 more.
Dependencies31
  • @anthropic-ai/sdk^0.92.0
  • @google/model-viewer^4.2.0
  • @modelcontextprotocol/sdk^1.29.0
  • @monaco-editor/react^4.7.0
  • @react-three/drei^10.7.7
  • @react-three/fiber^9.5.0
  • @supabase/supabase-js^2.105.4
  • @tanstack/react-router^1.170.2
  • @tanstack/router-vite-plugin^1.167.3
  • @techstark/opencv-js^4.10.0-release.1
  • @types/three^0.182.0
  • acorn^8.15.0
  • acorn-walk^8.3.4
  • astring^1.9.0
  • cmdk^1.1.1
  • commander^14.0.3
  • framer-motion^12.33.0
  • isosurface1.0.0
  • lucide-react^0.563.0
  • react^19.2.0
  • react-dom^19.2.0
  • react-markdown^10.1.0
  • replicad^0.23.1
  • replicad-opencascadejsgithub:w1ne/replicad-opencascadejs#kcad-v0.23.1
  • sharp^0.33.5
  • shiki^1.29.2
  • three^0.184.0
  • ts-morph^27.0.2
  • typescript~5.9.3
  • yaml^2.8.4
  • …and 1 more.