PkgRadar

Package evidence

[email protected]

Large Javascript Payload: 19536522 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
3,819,435Ubiquitous · −70% score
Versions published
280Mature · −50% score
First published
Oct 2014
Publisher
mbx-npm-04-production

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishermbx-npm-04-production
Artifact bytes13,771,690
Previous version3.24.0
Published2026-06-04T13:42:54.987Z
SHA-256b11aec7c63185fee966bc93caac93f4856fc1a67de4e3e0000ff9b3e2b404daa

Why flagged

What the scanner saw

Large Javascript Payload: 19536522 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
3.25.0-rc.1Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowLarge Javascript Payloadpackage/dist/mapbox-gl-dev.js19536522 bytes0

Manifest

Package metadata

Scripts56
  • build-allrun-p build-umd build-esm-dev build-esm-prod build-esm-prod-cdn build-csp
  • build-csprollup -c rollup.config.csp.ts
  • build-csspostcss -o dist/mapbox-gl.css src/css/mapbox-gl.css
  • build-devrollup -c --environment BUILD:dev
  • build-dtsdts-bundle-generator --no-banner --export-referenced-types=false --umd-module-name=mapboxgl --project ./tsconfig.browser.json -o ./dist/mapbox-gl.d.ts ./src/index.ts
  • build-dts-esmdts-bundle-generator --no-banner --export-referenced-types=false --project ./tsconfig.browser.json -o ./dist/esm/mapbox-gl.d.ts ./src/index.esm.ts
  • build-esm-devrollup -c rollup.config.esm.ts --environment BUILD:dev
  • build-esm-prodrollup -c rollup.config.esm.ts --environment BUILD:production,MINIFY:true
  • build-esm-prod-cdnESM_TARGET=cdn rollup -c rollup.config.esm.ts --environment BUILD:production,MINIFY:true
  • build-prodrollup -c --environment BUILD:production,MINIFY:true
  • build-style-specnpm run build --workspace src/style-spec && mkdir -p dist/style-spec && cp src/style-spec/dist/* dist/style-spec
  • build-tokennode build/generate-access-token-script.js
  • build-umdrun-s build-dev build-prod
  • bump-version./build/bump-version.ts
  • codegentsx ./build/generate-style-code.ts && tsx ./build/generate-struct-arrays.ts && tsx ./build/generate-typed-style-spec.ts
  • linteslint --cache .
  • lint-cssstylelint 'src/css/mapbox-gl.css'
  • prepare-release-pagesln -sfn $PWD/dist test/release/dist && ln -sfn $PWD/debug test/release/debug && cp debug/access_token_generated.js test/release/
  • prepublishOnlyrun-s build-all build-css build-style-spec build-dts build-dts-esm
  • pretest-rendernpm run build-dev
  • pretest-render-cspnpm run build-csp
  • pretest-render-prodnpm run build-prod
  • print-release-urlnode build/print-release-url.js
  • publish-alpha./build/publish-alpha.ts
  • publish-cdn./build/publish-cdn.ts
  • publish-release./build/publish.ts
  • sizesize-limit
  • startrun-p build-token watch-css watch-esm start-server
  • start-allrun-p build-token watch-css watch-dev watch-esm start-server
  • start-releaserun-s build-token build-all build-css print-release-url prepare-release-pages start-server
  • …and 26 more.