Package evidence

[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,839Niche · −30% score
Versions published: 329Mature · −50% score
First published: Aug 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes177,270

Previous version2.3.4

Published2026-06-15T21:45:22.356Z

SHA-256544b8fc3c67c381c9dbf77486fd091ad54273627b524cc6f2397a5213c187aa2

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

40h agoLast checked

reviewRisk

3Score

2.3.5-next.1781559918.frantic-julius-caesar.2611565Version

Status history (1 event)

new → available40h ago · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/cli-89e6b3db.js	matched "raw.githubusercontent.com"	12

Manifest

Package metadata

Scripts16

bump:tag:mainnpm dist-tag add needle-cloud@<version> main
deploynpm run dist & npm publish --access public
deploy:drynpm run deploy -- --dry-run
deploy:mainnpm run deploy -- --tag main
devconcurrently --kill-others "npm run dev:web" "npm run dev:node" "npm run dev:types"
dev:mcpnpx --yes @modelcontextprotocol/inspector mcp-inspector http://localhost:8424/mcp
dev:nodenode tools/write-build-info.mjs && microbundle watch -i ./src/cli.js -o dist/cli.js --format esm --target node --no-compress
dev:typesnpx --yes nodemon --watch src/web/web.types.d.ts --watch ../needle-share-sdk/types --watch dist/index.esm.js --ext js,ts,d.ts --delay 3 --exec "npm run dist:types"
dev:webnode tools/write-build-info.mjs && microbundle watch -i ./src/index.js -o dist/index.js --format esm --generateTypes --target web --no-compress
distnpx --yes rimraf dist && npm run dist:web && npm run dist:types && npm run dist:node
dist:nodenode tools/write-build-info.mjs && microbundle -i ./src/cli.js -o dist/cli.js --format esm --target node --generateTypes false --sourcemap false --compress --define api_endpoint=https://cloud.needle.tools/api,cloud_base_url=https://cloud.needle.tools,logto_endpoint=https://auth.needle.tools,logto_app_id=2stnsoa6a1b0gwc7lra55,logto_app_secret=seV1T6iKBKLlttjdk25I2px43ZCEHnPJ
dist:node-previewnode tools/write-build-info.mjs && microbundle -i ./src/cli.js -o dist/cli.js --format esm --target node --generateTypes false --sourcemap false --compress --define api_endpoint=https://cloud-staging.needle.tools/api,cloud_base_url=https://cloud-staging.needle.tools,logto_endpoint=https://auth.needle.tools,logto_app_id=2stnsoa6a1b0gwc7lra55,logto_app_secret=seV1T6iKBKLlttjdk25I2px43ZCEHnPJ
dist:typesnode tools/copy-web-types.mjs && rollup -c rollup.dts.config.mjs && node tools/clean-intermediate-dts.mjs
dist:webnode tools/write-build-info.mjs && microbundle -i ./src/index.js -o dist/index.js --format esm --generateTypes --target web --sourcemap false --compress true --define api_endpoint=https://cloud.needle.tools/api,cloud_base_url=https://cloud.needle.tools,logto_endpoint=https://auth.needle.tools,logto_app_id=2stnsoa6a1b0gwc7lra55,logto_app_secret=seV1T6iKBKLlttjdk25I2px43ZCEHnPJ
dist:web-previewnode tools/write-build-info.mjs && microbundle -i ./src/index.js -o dist/index.js --format esm --generateTypes --target web --sourcemap false --compress true --define api_endpoint=https://cloud-staging.needle.tools/api,cloud_base_url=https://cloud-staging.needle.tools,logto_endpoint=https://auth.needle.tools,logto_app_id=2stnsoa6a1b0gwc7lra55,logto_app_secret=seV1T6iKBKLlttjdk25I2px43ZCEHnPJ
install-local-depscd ../needle-share-sdk && npm install

Dependencies15

@caporal/core^2.0.7
@logto/browser^3.0.7
@logto/node^2.5.8
@web-std/file^3.0.3
body-parser^1.20.3
buffer^6.0.3
dotenv^16.4.5
express^4.21.1
minimatch^10.2.5
node-fetch^3.3.2
node-machine-id^1.1.12
open^10.1.0
ora^8.0.1
uuid^11.1.0
ws^8.18.3