Package evidence

[email protected]

Remote Dependency Spec: dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 154
Versions published: 9
First published: May 2026
Publisher: andriishylenko

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherandriishylenko

Artifact bytes10,177,809

Previous version0.12.0

Published2026-06-11T15:03:54.169Z

SHA-256a287c134171c3ff88ab4aa6ab313746257536271c3448eb0d6a57e2d7ca6cf15

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

3d agoLast checked

reviewRisk

12Score

0.12.1Version

Status history (1 event)

new → available3d ago · risk review · score 12 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"	12

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.replicad-opencascadejs="github:w1ne/replicad-opencascadejs#kcad-v0.23.1"	12
low	Large Javascript Payload	package/dist/cli/index.js	15878698 bytes	0

Manifest

Package metadata

Scripts52

buildtsc -b && vite build
build:clitsc --noEmit -p tsconfig.cli.json && node scripts/build-cli.mjs
capture-demonpx tsx scripts/captureDemo.ts
capture-demo:donutnpx tsx scripts/captureDemo.ts --script examples/v0.21/donut.kcad.ts --prompt scripts/demo-prompts/v0.21-donut.md --module v0.21 --output docs/demos/v0.21/donut/ --hero-artifact donut
capture-demo:heronpx tsx scripts/captureDemo.ts --task bracket-holes --module v0.21 --output docs/demos/v0.21/bracket-holes/ --hero-artifact bracket-holes --override-approved-by 'pre-Task-10: bracket-holes scheduled for replacement by donut'
capture-demo:retro-v0.1npx tsx scripts/captureDemo.ts --script examples/bracket-with-hole.kcad.ts --prompt scripts/demo-prompts/v0.1-bracket.md --module v0.1 --output docs/demos/v0.1/bracket-with-hole/ --hero-artifact bracket-with-hole --override-approved-by 'grandfathered: pre-policy v0.1 retro capture'
capture-demo:retro-v0.2npx tsx scripts/captureDemo.ts --task subtract-then-fillet-rim --module v0.2 --output docs/demos/v0.2/subtract-then-fillet-rim/ --hero-artifact subtract-then-fillet-rim --override-approved-by 'grandfathered: pre-policy v0.2 retro capture'
capture-demo:v0.6-heronpx tsx scripts/captureDemo.ts --script examples/robot-arm/desktop-3axis-mates.kcad.ts --prompt scripts/demo-prompts/v0.6.0-desktop-3axis-mates.md --module v0.6 --output docs/demos/v0.6/desktop-3axis-mates/ --hero-artifact desktop-3axis-mates
capture-demo:v0.7.1-patternsnpx tsx scripts/captureDemo.ts --script eval/tasks/grid-heat-sink-fin-array/solution-expert.kcad.ts --prompt scripts/demo-prompts/v0.7.1-grid-heat-sink-fin-array.md --module v0.7.1 --output docs/demos/v0.7.1/grid-heat-sink-fin-array/ --hero-artifact grid-heat-sink-fin-array
cookbook:buildnpx tsx scripts/buildCookbookIndex.ts
cookbook:evaluatenpx tsx scripts/cookbookEvaluate.ts
cookbook:validatenpx tsx scripts/cookbookValidate.ts
devvite
dist:skillsnpx tsx scripts/distGenerate.mjs
evalnpx tsx eval/run.ts
eval:abnpx tsx scripts/evalAb.ts
generate:partsnpx tsx scripts/generateSeedCatalog.ts assets/parts
linteslint .
lint-demosnpx tsx scripts/lint-demos.ts
portfolio:attemptnpx tsx scripts/portfolioAttempt.ts
portfolio:capturenpx tsx scripts/capturePortfolioEntry.ts
portfolio:validatenpm test -- tests/integration/portfolio/portfolioBundle.test.ts tests/unit/portfolio/portfolioMeta.test.ts
prebuildtsr generate
prepacknpm run build:cli
prepublishOnlynpm run generate:parts
pretestnpm run generate:parts
pretypechecktsr generate
previewvite preview
proof:assembly-contractnpm run proof:foundation && npm test -- tests/unit/assemblies/assemblyCapture.test.ts tests/unit/backends/occt/assemblyLowerer.test.ts tests/integration/examples/assemblyExamples.test.ts tests/unit/skill/skillGlobalsDrift.test.ts
proof:dist-skillsnpm test -- tests/unit/cli/walkSkillTree.test.ts tests/unit/cli/skillInstallRecursion.test.ts tests/unit/cli/skillInstallDeprecation.test.ts tests/unit/scripts/distGenerate.test.ts tests/unit/scripts/distSkillManifest.test.ts tests/unit/scripts/distHarnessAuthor.test.ts tests/unit/scripts/distGrepGate.test.ts tests/unit/scripts/distToolNameGate.test.ts tests/unit/scripts/distFsDiscoverySentinel.test.ts tests/unit/scripts/distReadme.test.ts tests/unit/scripts/distPostinstallScript.test.ts
…and 22 more.

Dependencies35

@anthropic-ai/sdk^0.92.0
@google/model-viewer^4.2.0
@modelcontextprotocol/sdk^1.29.0
@monaco-editor/react^4.7.0
@mujoco/mujoco^3.9.0
@react-three/drei^10.7.7
@react-three/fiber^9.5.0
@supabase/supabase-js^2.105.4
@tanstack/react-router^1.170.2
@tanstack/router-vite-plugin^1.167.3
@techstark/opencv-js^4.10.0-release.1
@types/three^0.182.0
acorn^8.15.0
acorn-walk^8.3.4
astring^1.9.0
cmdk^1.1.1
commander^14.0.3
dxf-parser^1.1.2
fflate^0.8.3
framer-motion^12.33.0
isosurface1.0.0
lucide-react^0.563.0
react^19.2.0
react-dom^19.2.0
react-markdown^10.1.0
replicad^0.23.1
replicad-opencascadejsgithub:w1ne/replicad-opencascadejs#kcad-v0.23.1
sharp^0.33.5
shiki^1.29.2
three^0.184.0
…and 5 more.

Optional dependencies1

playwright^1.58.0