Package evidence

[email protected]

Remote Dependency Spec: dependencies.aphrodite="https://github.com/learningequality/aphrodite/"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 707
Versions published: 51Mature · −50% score
First published: Feb 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes2,331,054

Previous version5.6.0

Published2026-03-31T22:26:31.537Z

SHA-25662c73106b5c17941008d4f1d0f9e3b2edd65e06ad7f0429a97d35100a3e8d6aa

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.aphrodite="https://github.com/learningequality/aphrodite/"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

42h agoLast checked

reviewRisk

6Score

5.6.1Version

Status history (1 event)

new → available42h ago · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.aphrodite="https://github.com/learningequality/aphrodite/"	12
medium	Remote Dependency Spec	package.json	devDependencies.@material-icons/svg="git+https://github.com/material-icons/material-icons.git"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.aphrodite	https://github.com/learningequality/aphrodite/	error	0	invalid gzip header

Manifest

Package metadata

Scripts13

_api-watchchokidar "**/lib/**" -c "node utils/extractApi.js"
_lint-watch-fixyarn lint -w -m
devconcurrently yarn:dev-only yarn:_api-watch yarn:pregenerate
dev-onlynuxt --port 4000
generateyarn run pregenerate && nuxt generate
lintkolibri-format --pattern '**/*.{js,vue,scss,less,css}' --ignore '**/node_modules/**' '**/.nuxt/**' '**/dist/**' '**/lib/KIcon/precompiled-icons/**' '**/lib/keen/**' '**/docs/environment.js' '**/docs/jsdocs.js'
lint-fixyarn lint -w
precompile-custom-svgsnode utils/precompileSvgs/index.js --custom && yarn run pregenerate
precompile-svgsnode utils/precompileSvgs/index.js && yarn run pregenerate
pregeneratenode utils/pregenerate.js
testjest --config=jest.conf/index.js
test:percyPERCY_LOGLEVEL=info npx percy exec -v -- jest --config jest.conf/visual.index.js
test:visualVISUAL_TESTING=true concurrently --kill-others --success first --names "SERVER,TEST" -c "bgCyan.bold,bgYellow.bold" "yarn dev-only > /dev/null 2>&1" "yarn test:percy"

Dependencies16

aphroditehttps://github.com/learningequality/aphrodite/
autosize3.0.21
color4.2.3
css-element-queries1.2.0
date-fns1.30.1
frame-throttle3.0.0
fuzzysearch1.0.3
lodash4.17.23
node-glob^1.2.0
popper.js1.16.1
purecss2.2.0
tippy.js4.3.5
vue2
vue-intl3.1.0
vue2-teleport1.1.4
xstate4.38.3