PkgRadar

Package evidence

[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
109Established · −30% score
First published
Nov 2025
Publisher
simon_he

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishersimon_he
Artifact bytes239,211
Previous version1.0.1-beta.4
Published2026-06-05T01:23:33.391Z
SHA-256ed9056f300c2e9c560609076ea2312a6be3c48a8e0c5f37517ecef02011003f2

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
1.0.1-beta.5Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts138
  • benchmark:1.0node scripts/benchmark-1-0.mjs
  • benchmark:streaming-splitnode scripts/benchmark-streaming-split.mjs
  • buildpnpm run build:core && vite build --mode npm && node scripts/cleanup-style-entry.mjs && node scripts/write-tailwind-types.mjs && vite build --config vite.config.tailwind.ts --mode npm && node scripts/copy-tailwind-css.mjs && node scripts/generate-px-css.mjs && pnpm run build:dts
  • build:analyzeANALYZE=true pnpm build
  • build:corepnpm run -C packages/markstream-core build
  • build:demovite build
  • build:dtsrollup -c ./scripts/rollup.dts.config.mjs && node ./scripts/clean-dts.cjs --strip-comments
  • build:dts:packrollup -c ./scripts/rollup.dts.config.mjs && node ./scripts/clean-dts.cjs --strip-comments
  • build:packpnpm run build:core && vite build --mode npm && node scripts/cleanup-style-entry.mjs && node scripts/write-tailwind-types.mjs && vite build --config vite.config.tailwind.ts --mode npm && node scripts/copy-tailwind-css.mjs && node scripts/generate-px-css.mjs && pnpm run build:dts:pack
  • build:parserpnpm run -C packages/markdown-parser build
  • build:viewvite preview
  • changelogconventional-changelog -p angular --tag-prefix markstream-vue@ -i CHANGELOG.md -s -r 1
  • check:core-publishednode ./scripts/check-core-published.mjs --package-json package.json --core-package-json packages/markstream-core/package.json
  • check:packed-workspace-depsnode ./scripts/check-packed-workspace-deps.mjs --package-json package.json
  • check:peer-depsnode ./scripts/check-peer-deps.cjs
  • check:ssrvitest --run test/ssr-import.test.ts test/ssr-render-to-string.test.ts
  • check:workspace-deps-localnode ./scripts/check-workspace-deps-local.mjs
  • check:workspace-deps-publishednode ./scripts/check-workspace-deps-published.mjs
  • devpnpm run -C playground dev
  • docs:buildvitepress build docs
  • docs:build:cipnpm run build:parser && pnpm run build && pnpm docs:build
  • docs:build:ghVITEPRESS_BASE=/markstream-vue/ pnpm docs:build
  • docs:build:gh:cipnpm run build:parser && pnpm run build && pnpm docs:build:gh
  • docs:build:netlifyVITEPRESS_BASE=/ pnpm docs:build
  • docs:check-zhnode scripts/check-zh-parity.mjs
  • docs:deployVITEPRESS_BASE=/markstream-vue/ pnpm docs:build && pnpm docs:serve
  • docs:deploy:netlifypnpm docs:build && echo 'Docs built to docs/.vitepress/dist'
  • docs:devvitepress dev docs
  • docs:servevitepress serve docs
  • docs:sync-zhnode scripts/sync-zh-docs.mjs
  • …and 108 more.
Dependencies4
  • @chenglou/pretext^0.0.5
  • @floating-ui/dom^1.7.6
  • markstream-core1.0.0
  • stream-markdown-parser1.0.3